> companies want control over where their data goes

That's the age-old problem that's the root of this debacle, too. Both the companies and the users want control over a shared resource, and each side has a different opinion on where the border lies :).

(In practice, as a user, that's why my mind reads the phrase "OAuth redirect vulnerabilities" as a feature of a product, not a bug.)