>OAuth is a Authorization protocol, not an Authentication protocol however people do mix in the authentication into the flows.

This is what I don't get. Using OAuth2 for authentication is so complex, whereas Ory has a simple authentication system based o cookies: https://www.ory.sh/docs/security-model

With OAuth2 it seems to me to be the same just with extra steps keeping track of tokens and expiration. Why use OAuth2 for authentication, it was never designed for that.