RFC8628 has been out for eight years, OAuth isn't standing in the way of bots anymore.

OAuth/OIDC is a problem if you're trying to shove a bot-shaped peg into a browser-shaped hole, but we don't need a new protocol to solve that.