Thank you! That makes sense. A malicious dev would be okay with implementing Google's and Facebook's SSO solution because it allows them to continue accessing t

Thank you! That makes sense. A malicious dev would be okay with implementing Google's and Facebook's SSO solution because it allows them to continue accessing the user's email. However, Apple's policy gives malicious devs an obvious way out: just don't support any SSO solutions. So this policy doesn't really do anything to stop malicious devs at the end of the day. It stops them from taking advantage of alternative SSOs, but I wouldn't expect that to have much effect. I guess maybe the policy is intended to mitigate the potential damage caused by negligent devs? As in devs who are not malicious, but risk allowing malicious actors to access user data through negligent design? That feels more like stretch to me, though.