I understand these cases are structurally different. I just don't see how a quasi-ban of hardcoded passwords could work, given current industry practices.
And I'm not sure these client-side secrets/group passwords are entirely meaningless. Some people somewhere must ascribe some security-related property to them.
I think this is just a case of the APIs here supporting client ids and secrets so that users can control who uses the API on their behalf… but it being up to the API user to decide how much they care about who they share that client secret with.
If Thunderbird shared their Netflix password in here, that wouldn’t say anything about the quality of Netflix’s security implementation or the security value of Netflix passwords in general - it tells you Thunderbird don’t care about how their Netflix account gets used.
And in terms of the structural difference - this is of course a hardcoded credential used to identify this client to a service - the case at hand is about a hardcoded credential authentication embedded in a service, used to authenticate clients. We can distinguish those cases regulatorily.
And I'm not sure these client-side secrets/group passwords are entirely meaningless. Some people somewhere must ascribe some security-related property to them.