Client-wise maybe, but the whole IdP part is an entirely different and a whole lot more complicated.

If it would have been that easy, everybody would build OAuth/OIDC providers left and right.

Have you actually rolled out such a solution yourself? Yes, the contractual obligations of the protocol are deceptively shallow, but that is the easiest part. We’re not just talking about assembling a JWT and asserting it. We’ve got to hook up all the plumbing for signing, key management, credential management, various auth flows (after all, not all apps are created equality), RBAC, SSO, federation, custom rules, and all the accoutrement in between. Yeah, great, you can hack in a solution for your simple app, and if your use case lets you get away with it then go with god. A fully compliant system, batteries included, is a staggering amount of work.