There are several flows possible with OAuth2. This is only one of them. So his critique is based on the total of OAuth2, not this small part that is fairly simple.