OAuth2/OIDC isn't enough. There's many cases where they're not an option at all; outside of (internet-connected) browser flows, you need more solutions. They ad

OAuth2/OIDC isn't enough. There's many cases where they're not an option at all; outside of (internet-connected) browser flows, you need more solutions. They add a ton of complexity and are difficult to implement correctly. They don't support other protocols. The implementation of each is specific to the provider ("scopes" is application-specific, etc). You aren't guaranteed to get all the functionality (grant types), assuming all parties have implemented them. And it doesn't provide a standard for MFA, challenges, recovery, secret storage, secure login to the IdP, etc. It really only covers a single use-case. When people do implement that use-case, they often do so improperly, leading to gaping security holes. So we need more standards. But those standards need to come in three varieties: 1) new standards, 2) simpler designs, 3) guidelines for implementations. There are solutions that exist today, that have no standard. There are "standard" designs today, but they're overcomplicated. And we need better guides on how to implement standards so that users (and developers) have an easier time using the solutions.