I'm kind of on the fence if I even believe this to be true or not.
The OAuth 2.0 flows themselves are authorization (i.e. authorizing the clients to act on behalf of the user) but the service account flows are user-independent and really serve to authenticate an entity with a given access.
Also, when we use non-service accounts we just use the Application Default Credentials from the gcloud CLI. These will already have a refresh token, so again we perform / participate in no authorization, just authentication.
PS Sorry for the esoteric issue, but I was adding this section to the gcloud-python README and it just occurred to me.
PPS Is there some magic trick to get a link to lines in a MD file on GitHub?