That is a really bad specification with no examples, no formalization, and zero references. However, all server-side attack scenarios listed there are not poss

That is a really bad specification with no examples, no formalization, and zero references. However, all server-side attack scenarios listed there are not possible with Hydra. Some of them also boil down to misusing OAuth2 for authentication, which is why we have OpenID Connect.