It would be a PITA for developers, but if it was the norm, you wouldn't think about it twice.
The minimum scope should be a random identifier that's unique to the service provider you are logging in to.
That being said, this approach requires monitoring and enforcement; otherwise nothing prevents the developer from not allowing the user to proceed without granting some specific permissions. Facebook again seems relatively strict here, at least post- Cambridge Analytica.
The callback page would tell you that you screwed up, give you a link to try again, and not let you authenticate until you offer the proper scope.
I can't imagine anyone else doing much different than that outside of special cases.
the scope mechanic would have to be reworked altogether if this feature has any chance of actually achieving the desired effect, so a scope can only be granted for n-minutes or something. But that would make a lot of good use-cases borderline impossible (i.e. the previously mentioned alternative frontends for popular pages).
Its really hard without revamping the oidc standard altogether, but thats unlikely to happen as well. Good authentication/authorization is just super hard and continues to be unsolved, especially if untrusted entities are involved.
Why on earth would anyone use SSO? Are we that lazy?