A5 attacker model?

Issue #338 resolved
Brian Campbell created an issue

With "shall distribute discovery metadata (such as the authorization endpoint) via the metadata document as specified in [OIDD] and [RFC8414]" in baseline, is the "A5 - Read Token Requests and Responses" really relevant?