OAuth2 was designed in a time when everybody thought consolidating logins would be wise, and just use Google / Facebook / Microsoft accounts to login everyhwere.

OAuth2 was production ready when everybody realized having FAANG logins is insane, as they use it to massively track you on websites that else would be beyond their reach. And since reports off random FAANG account shutdowns, it is even wise not to use them when you are okay with tracking, as suddenly a handfull of FAANG megacorps have the power to shut down your digital life with a click.

So here we are, having to deal with massive protocol overhead for a feature most of us don't want anymore.