The takeaway is that everyone makes security hard. Everyone does this anti-pattern of having these other domains that defeat all their own security recommendations.

GitHub for ages had something like githubnext.com where they would make you do this same OAuth dance (except IIRC it was worse - it explicitly said that it WASNT GitHub). Apple has/had an apple.tv microsite or something they hosted content on.

Your bank will send you “legitimate” surveys or communication from some third party domain like qualtropics.com.

Fricken Proton has a separate domain that lists all of their apps, https://protonapps.com/. This absolutely screams "scam", but no, it's real.

Ffs, just put this on apps.proton.me or something so I actually know it's real!