OAuth 2 makes it possible to have mobile apps authenticate without login (there was no secure way to do this with OAuth 1 so in the past requests like T179519: Implementing OAuth in Wikimedia Commons Android app have been rejected). Having the apps use that rather than password-based login would have several advantages:

• They would be able to use a mechanism that's guaranteed to be stable, rather than adapting to changes in the interactive authentication flow. That would reduce maintenance burden on both app maintainers and authentication system maintainers.
• There would be no need to enter the password on the app so there would be no way to steal it that way (e.g. on a rooted phone taken over by a malicious app).
• OAuth provides a granular permission model, so even if some malicious app on the phone could access OAuth credentials, the abuse potential would be very limited.

This would require some work on both sides, but not that much, I think:

• Apps would have to implement OAuth 2, but there are tons of libraries to help with that. They would have to rely on a web view for the OAuth authorization dialog, and the user would have to log in in the web view at that point - not great for UX and security, but doesn't take any effort to implement. In the long term, maybe it can be avoided by some kind of challenge-response thing.
• In the OAuth extension, we'd want to add some sort of "internal app" where the scopes etc. can be changed without having to register a new app ID / secret, as those would have to be hardcoded in the app. And maybe suppress change tags.