As I understand it, zero-legged OAuth is where the normally temporary token/secret codes are decided on beforehand and are made to not expire, so there's no authentication step needed before you make "actual" requests of the backend REST API. To me, that seems to go against the standard. Am I right in thinking this?
The authentication is in practice no different- the same secret is used as in other flows by the client to create a signature or otherwise provide proof of possession of the secret.
The difference is on the service providers side. Every service provider endpoint participating in zero-legged-auth needs to know how to access the provider's form of the client secret, to be able to directly validate requests signed with the secret.
This is a less capable, more monolithic and potentially less secure architecture- less secure because of the need to distribute the actual shared secret, rather than a limited-use token.