it's only in theory, in practice not going to happen.

In most of the cases, authorization servers are called from each microservice.

evented systems loopback and it's difficult to avoid it, e.g.: order created -> charge -> charge failed -> order cancelled