There are several flows possible with OAuth2. This is only one of them. So his critique is based on the total of OAuth2, not this small part that is fairly simple.

Probably not (based on the time between the critique and the release)