As others have said, JWT, in practice, is effectively forced by the extensions/OIDC, I was just being short.

It shouldn't be about demand. It's about solving the danger of these poorly designed APIs to improve overall web security.