Section 2.1.1 of IETF's OAuth 2.0 Security Best Current Practice begins as follows:
Clients MUST prevent injection (replay) of authorization codes into the authorization response by attackers. Public clients MUST use PKCE [RFC7636] to this end. For confidential clients, the use of PKCE [RFC7636] is RECOMMENDED. With additional precautions, described in Section 18.104.22.168, confidential clients MAY use the OpenID Connect "nonce" parameter and the respective Claim in the ID Token [OpenID] instead. In any case, the PKCE challenge or OpenID Connect "nonce" MUST be transaction-specific and securely bound to the client and the user agent in which the transaction was started.
I understand why "public clients MUST use PKCE;" RFC 7636 explains why it is necessary for public clients very clearly. However, why is PKCE "RECOMMENDED" for confidential clients? I read the RFC and was not able to find the rationale for that.