Usually OAuth is used by a user to give access to resource to a third party, which is the client in the OAuth framework. So in the implicit flow the user might see the access token, however they already had access to begin with so that is not a problem.
So the steps are like this:
- Redirect user to authorization server
- User authenticates and provides consent
- User is redirected to Client with access code (or error code)
- Client webserver captures the access code
- Client backend exchanges the access code for an access token through a direct back channel call to the authorization server (notice the user's browser is not involved here)
- Client can now use the access token, and possible refresh token, to access the resources the users has provides access to.
If you implement OAuth correctly it can be a very secure way authorisation. But that is a big if.