really?
both Azure AD and AWS Cognito use RS256 as the only algorithm supported.
perhaps my sample size is small.
A simple closely related field: OAuth 2 token replay attacks. I auth against A with Facebook, A uses token to impersonate me against B. ISTR Google had basically the same bug. A median startup will not find that bug. Storing a random token in a database? Very likely they won't mess that one up. Also, if you do (let's say your randomness generator is MT as opposed to a CSPRNG), it's easy to fix, because you control the validation endpoint.
You can't say password based authentication is bad because some developers choose to store password in plain text. The blame squarely lies with the developer.
People implementing auth without willing to go a little deeper may hurt themselves.