Right. At least, that is how it would work for a Google Account using OAuth 2.0. As implied in the question, I assume the principles can be generalized as applying to multiple apps, including Pocket with a Firefox Account.
The authorization endpoint is displayed inside an embedded user-agent disallowed by Google's OAuth 2.0 Policies.
Android developers may encounter this error message when opening authorization requests in android.webkit.WebView. Developers should instead use Android libraries such as Google Sign-In for Android or OpenID Foundation's AppAuth for Android.
Web developers may encounter this error when an Android app opens a general web link in an embedded user-agent and a user navigates to Google's OAuth 2.0 authorization endpoint from your site. Developers should allow general links to open in the default link handler of the operating system, which includes both Android App Links handlers or the default browser app. The Android Custom Tabs library is also a supported option.
Use secure browsers
A developer must not direct a Google OAuth 2.0 authorization request to an embedded user-agent under the developer's control. Embedded user-agents include, but are not limited to, software libraries that allow a developer to insert arbitrary scripts, alter the default routing of a request to the Google OAuth server, or access session cookies. All browsing environments must allow the user to verify the current connection to the Google OAuth server including the requested URI and connection security information.
8.6. Client Impersonation
As stated in Section 10.2 of OAuth 2.0 [RFC6749], the authorization
server SHOULD NOT process authorization requests automatically
without user consent or interaction
The last document appears to suggest that the app could receive the login session secret by registering a custom URL. Although, I tried disabling "open supported links" for Pocket, and the Firefox Account login flow still worked without a hiccup. It sounds to me like the custom URL method would be unnecessary and fragile.