First of all the AS decides whether it issues refresh tokens or not. Having the ability does not mean the AS must do it. If you feel it’s safer to not do it. Fine.
Sure, and this should be mentioned then somewhere (either in the threats doc or in this proposed best practice doc). Not all end developers using these protocols fully understand the ramifications.
Aaron: I suggest this goes to the SPA BCP since this is client specific.
https://www.ietf.org/mail-archive/web/oauth/current/msg18518.html