My favourite are the appendices that amend the protocol to fix security issues that almost no API seems to implement properly. These can get quite long and are

My favourite are the appendices that amend the protocol to fix security issues that almost no API seems to implement properly. These can get quite long and are frequently amended with new drafts every year or two. For example, most APIs don't implement PKCE in order to prevent injection attacks against the authorization code grant type. Just keeping up with security practices is a full time job for teams.