I don't even mean federated auth. I mean if you take some email client application that went out of it's way to support OAuth2+imap for google via a plugin the

I don't even mean federated auth. I mean if you take some email client application that went out of it's way to support OAuth2+imap for google via a plugin then even if you replace all of google's info in the plugin it won't work for other OAuth2+imap implementations. Every OAuth2 implementation is a different thing, as you say. But the megacorps are pretending it's some standard protocol. It's not and the fallout will be much worse than people having issues because they picked easy passwords. This is massively different than actual protocols like pop3 or imap where all you do is change the info but the protocol stays the same.