Oauth 2 is an authorization standard, that’s basically what it is meant for. It’s intended to be used as a identification system for a client to be able to tell a first party hey I’m me through the usage of a third party without ever giving the third party to have your password.

Discord, Facebook/Meta, Google(most services), Soundcloud, all those use Auth 2 based API’s, oauth 2 is used basically everywhere for the same focus that Reddit is trying to do

Like you said it can be dangerous if you authorize a third party app with more scopes then needed(scopes help restrict what the app can do on your behalf), honestly I’m willing to bet that rif and Apollo both used the oauth2 API at least in some part, otherwise I don’t think it would have been able to allow you to upvote or downvote posts or post comments as you. A good way to tell if it was using it or not is if you had to login and it brought you to a page that said authorize this app with Reddit, if it showed that you were using oauth 2

I haven’t personally had to use the Reddit Api I’ve only skimmed it myself(I was looking into it then the whole bombshell happend and I bailed), but I have to use the Discord API daily with developing my Discord bot and with the Discord API once you have the bearer token every form of authentication with that specific user goes through that token instead, it’s really only used for the website settings page though anything actually on the client itself still uses a standard bot token

Also I fully agree, Reddit has shown that it has no respect for the third parties on the platform so I fully expect just going to get worse, they wern’t planning on negotiating price, they set it that way to force third party out