DPoP's protection of refresh tokens reduces the scope of impact after a token leak, but access tokens remain Bearer, and an access token leaked within its validity period can still be abused.