RFC8628 has been out for eight years, OAuth isn't standing in the way of bots anymore.

OAuth/OIDC is a problem if you're trying to shove a bot-shaped peg into a browser-shaped hole, but we don't need a new protocol to solve that.

It's probably for the better that they're having trouble with it, if trouble actually means increased workload.

If my security system is showing friction when there's a wave of agentic slop, I'd say that's a win.