I guess the general problem with security is that developers use libraries (and frameworks) so as to not have in-depth understanding of the functionality that l

I guess the general problem with security is that developers use libraries (and frameworks) so as to not have in-depth understanding of the functionality that library provides. That becomes an issue when the library doesn't provide sane defaults or too many options, i.e. ways to shoot yourself in the foot by choosing bad options either by own choice or by programming error – relying on malicious client input. Libraries that provide one solid hard-coded implementation based on current best practices are a much better idea for most projects, but of course what then with giant specs like Oauth and OpenID Connect...