There’s probably a PR or a thread somewhere with a bunch of very angry nerds fighting over whether this is even a useful feature and there’s no API because they can’t reach a compromise. There is no design.

I hate this. I don’t want to remember which provider I use for each site and I don’t want accidentally give too many permissions while logging in. Just give me email and password inputs, don’t block password managers and don’t force any magick link nonsense and I’m happy. I don’t even need passkey support

Nowadays the answer is probably a 5,000-word essay that no one has (or will) read

All I remember is that they used to automatically inject ads and spyware to downloadable files. No idea if they still do that, most likely yes