I think this is a fairly elitist view and I disagree. I work in application security and still have trouble understanding all the behaviours of oauth and oidc,

I think this is a fairly elitist view and I disagree. I work in application security and still have trouble understanding all the behaviours of oauth and oidc, even after reading the specs multiple times. If I can’t understand it fully, how are you going to expect some developer who has no security or crypto background implement it correctly when nobody is there to validate the implementation? I feel like the oauth/oidc are insecure not because of the core logic, but because the design and terminology aren’t easily understood - that complexity IS a vulnerability.