They are totally different format: different structure, different keyword, different time date format, different escape way, different language specifying way…
Their common parts are only both used for feed and both use XML.
And even more, interoperability of RSS 2.0 itself is horrible, RSS 2.0 standard left too many details in not specified situation, such as how to deal with relative URL…
For more infomation, you can read https://www.intertwingly.net/wiki/pie/Rss20AndAtom10Compared

Unfortunately, IIRC, some feed readers only support RSS, not Atom. Those users may see some warning like “invalid format”.

There are some code updates to refactor API call two months ago on Codeberg.

It should be an implementation issue completely. You can read through the RFC 9700: Best Current Practice for OAuth 2.0 Security, they list many requirements to implement a secure OAuth, such as use short lifetime access token, access and refresh token should be sender-constrained, access token should be restricted to minimium permissions, and so on. The softwares you mentioned violated many rules.

https://datatracker.ietf.org/doc/html/rfc9700