NOTE: this question is very similar to what's the alternative to password grant now that it is deprecated? OAUTH 2.0. I'm asking it anyway because the answers to that question don't actually answer the question...

I've been researching this topic all day and have not found the answer I'm looking for, so here goes...

I'm setting up a web app with a FastAPI backend and a React frontend. I want to implement an authentication system. In the documentation for FastAPI, the security set up uses the OAuth "password" flow - and I would like to use this flow, adding JWTs to an httpOnly cookie for secure authentication.

However - there is a lot of fanfare online about how the password flow is deprecated and you "shouldn't" use it: https://www.oauth.com/oauth2-servers/access-tokens/password-grant/

So my questions are:

1. Should OAuth flows ever be considered for first party apps that aren't interested in providing resources to third party apps (or vice versa)? Given that OAuth is about authorization and not authentication, then it makes sense that in this case we just don't use OAuth. And if we don't, then why do the FastAPI docs recommend it?
2. In the event that we do want to use an OAuth flow, what's wrong with the password grant? I can't see any reason why it's not an effective way to do authentication (in my case).

It would be great to have a discussion about this since I'm a little confused...