I've never seen an authorization server that works that way. Because I walked to make sure I wasn't missing anything, I went back and reviewed all the guidance I could find on the matter and can't find any reference to the suggestion you make.
The spec says, "If the authorization server observes multiple attempts to exchange an authorization code for an access token, the authorization server SHOULD attempt to revoke all access tokens already granted based on the compromised authorization code."[1]
If an authorization server implements the recommended behavior and an auto-redirect, doesn't that mean that GET requests will no longer be safely considered immutable since they may cause revocation of previous access_tokens?
Reusing the same authorization code should of course be considered suspicious.
This is only enforced for public clients though that don't have verifiable reply URIs - so web sites are OK.
Do they also disallow the use of refresh tokens? It would seem that allowing refresh would let a malicious app get around the requirement.