Why does the AADB2C Identity provider require a Client Secret?

[shawnmurtagh]

Why does the AADB2C Identity provider require a Client Secret when it is using a SPA code grant flow that doesn't use a secret?

From docs: https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-aad-b2c#configure-identity-provider-for-developer-portal

From the same docs:

We tested rotating the secret and found that even when we enter an invalid secret (e.g., "abc") and update the developer portal, we are still able to log in using the AADB2C OAuth 2 button.