Hi @paulalex,
Welcome to the Auth0 Community!
Before replying to your questions, I want to clarify one thing: the article is about using ID and access tokens in the OpenID Connect and OAuth2 context.
You mentioned an “ID JWT”. I don’t know if you mean a generic JWT, that is, a generic token in JWT format, or an ID token issued by an OIDC provider.
In the first case, you can use it as you prefer. It’s your own artifact, and maybe you have your own flow to grant security.
In the second case, i.e., you are using an ID token issued by an OIDC/OAuth authorization server, you should stick with the standard, and hence, with the purpose those artifacts are meant for.
You are free to ignore the standard’s recommendations, of course
There are companies that use ID tokens to call their own API (first-party scenario).
This is actually a sort of customization of the standards for their own needs. That means that some of the standard’s recommendations to grant security might not be valid.
In the case of using an ID token to call an API instead of an access token, the article outlines some of the problems that can arise.
To summarize it with a funny image, stairs were not invented to be used with skates.
Sure, you can try to go down the stairs with skates, but don’t be mad at them if you fall down.
To go down the stairs with skates, you may have to modify them a little. But at that point, they are no longer "standard" stairs.
I hope this clarifies a bit.