Even then you should still use authz with pkce. At the very least nobody else should be able to get your access token. For some workflows this is all the guarantee you need.