I think the problem with the spec is that it’s way too large to fully implement when you only need some secure token exchange, so everyone does only the stuff they need.

If the spec was smaller people would go all the way to be fully compliant since the marginal effort would be minimal.