> This is how all oidc providers work. No. When an app is registered with them, a provider does check if the scopes requested have a reasonable business purpos

> This is how all oidc providers work. No. When an app is registered with them, a provider does check if the scopes requested have a reasonable business purpose. Many registration forms even ask you to explain why you need the scopes requested. This is similar to how Apple App store does review. Many OAuth providers also check periodically if one of their registered apps is used for any pattern of abuse.