You're right! That probably makes is more feature request, less bug report. (extremely low priority FR)

Whatever bug is preventing the removal of phabricator.com from App Domains is at fault here. It's presence authorizes the entirety of the domain for the OAuth flows (unless overridden by "Valid OAuth redirect URIs"). We (Facebook) need to do a much better job of guiding developers through reducing OAuth attack surface - the redesigned dev site is noticeably worse in this context.