Ask HN: Why is OAuth still hard in 2023?

Why do you think OAuth remains challenging even in the current technological landscape? Just yesterday, I came across a post discussing CVE-2023-28131, a vulnerability that has impacted hundreds of websites.

How can we address the recurring vulnerabilities and make OAuth more user-friendly and secure?