Looks like Apple fixed all of the critical issues here https://bitbucket.org/openid/connect/src/default/How-Sign-in... but left in some "peculiarities," some of which are quite unpleasant.

> The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope.

So if you don't ask for the user's email right up front, you can never ask for it again later?!