This is a great improvement.

The following content pertains to the OpenID Connect plugin rather than this PR.

However, in my opinion, the primary purpose of an API gateway is API proxying, handling token verification during this process, rather than acting as some kind of identity proxy.

For token verification, this is stateless. We don't need to manage sessions; verifying each request individually suffices.
The web mode (bearer_only = false), however, requires us to handle session caching in the authorization_code flow. This imposes additional work—accepting codes, exchanging tokens, establishing and maintaining sessions—forcing the gateway to manage extra stateful work.
This introduces various long-tail error scenarios and makes debugging difficult. If the sole purpose is identity proxy, perhaps create a new plugin to move the functionality or integrate with an external service to implement forward-auth.