Because it's too flexible, and allows the OAuth provider to choose which features they support. That puts all the complexity on the client to support every poss

Because it's too flexible, and allows the OAuth provider to choose which features they support. That puts all the complexity on the client to support every possible implementation.