I think there is a mistake in the sequence diagram for 3rd party auth flow - the arrow nr 5 from the top (Authorization code) should go to MCP Server, not to 3rd party Auth Server - which is exactly the problem you’re describing 
Great read! And apparently there is hope already - Issue 205 has just been resolved with an update to the spec.