OAuth and OpenID Connect can be _conceptually_ hard; you are abstracting authentication and authorization into a protocol and therefore inheriting someone else's model. When that model is presented in the form of a spattering of specifications, understanding and mapping to that model can be really laborious . You also may be doing this as part of a new architecture on your side (e.g. moving from traditional server-side rendered web applications to PWA/SPA apps using APIs).
Strong Authentication and Account Lifecycle Management actually are just a whole lot of logic. Authentication is also something which is continually evolving to stay ahead of attackers. They are hard from the perspective of amount of work required, the distraction from your actual product mission, and the consequence of getting them wrong.
Maybe something like: https://en.wikipedia.org/wiki/Specification_and_Description_...
What makes this all rather critical is that these are security procedures and, and complexity is the foe of security.
I think the important take-away from all this is that OAuth and OpenId and what have you are very complicated.
That would seem to be the reason many companies can make a living out of providing them to you.
Now could it all be made easier and simpler to understand somehow? Don't know but that would be great.