Is that really a concern though in the same way API keys are? Since when do OAuth clients store refresh tokens in areas that LLMs regularly scan? API keys are truly passwords, while refresh tokens are exchanged for a password.
Sure, a leak would be bad but I'd argue that it's orders of magnitude less likely compared to the accepted norm.
Sure, a leak would be bad but I'd argue that it's orders of magnitude less likely compared to the accepted norm.