Microsoft sign in works without redirect url

When I sign in with Microsoft OAuth in my Blazor app, authenticateResult.Succeeded is true, even if I don't specify a redirect URI. It's failing as intended for Google, if I don't add my URI to the OAuth client.

Imo it shouldn't work without that redirect URI, according to the OAuth2.0 spec:

The authorization server MUST require public clients and SHOULD require confidential clients to register their redirection URIs.

I'm using Microsoft.AspNetCore.Authentication.MicrosoftAccount 3.0.3 with .NET Core 3.0

public class ExternalLoginModel : PageModel
{
    public IActionResult OnGetAsync(string externalAuthType, string returnUrl)
    {
        var authenticationProperties = new AuthenticationProperties
        {
            RedirectUri = Url.Page("./externallogin",
            pageHandler: "Callback",
            values: new { returnUrl }),
        };

        return new ChallengeResult(externalAuthType, authenticationProperties);
    }

    public async Task<IActionResult> OnGetCallbackAsync(
        string returnUrl = null, string remoteError = null)
    {
        var authenticateResult = await HttpContext.AuthenticateAsync("External");

        if (!authenticateResult.Succeeded) // Should be false for Microsoft sign in
            return BadRequest();

        ...

        return LocalRedirect(returnUrl);
    }
}

With the following added to my Startup:

        services.AddAuthentication(o =>
        {
            o.DefaultSignInScheme = "External";
        }).AddCookie("External");
        services.AddAuthentication().AddGoogle(google =>
        {
            google.ClientId = Configuration["Authentication:Google:ClientId"];
            google.ClientSecret = Configuration["Authentication:Google:ClientSecret"];
        });
        services.AddAuthentication().AddMicrosoftAccount(microsoftOptions =>
        {
            microsoftOptions.ClientId = Configuration["Authentication:Microsoft:ClientId"];
            microsoftOptions.ClientSecret = Configuration["Authentication:Microsoft:ClientSecret"];
        });

My App's Authentication settings look like this (I'm actually using localhost:12345 in the settings, but that's not what my app is running on..):

Ironically the last sentence might explain it, but I don't even know which flow the MicrosoftAccount library is using and I only get generic documentation when googling.

It fails as intended when using a completely different domain, not localhost with different ports. I guess that's good enough.

Additionally I unchecked "ID token" and "Treat application as a public client", therefore Authorization code flow should be used, to my understanding.