I believe this is incorrect. The authorization code flow with PKCE is certainly for SPAs. The implicit grant was historically used for SPAs because of browser limitations…which is no longer the case. FYI, your own documentation talks about this: OAuth2 Implicit Grant and SPA