For legacy reasons, the scope value in TokenClaimsSet and its token-type specific subclasses is required to be non-null. The flows/endpoints are already compatible with the plain OAuth2 requests: unlike with OIDC, the use of scope is then optional.

For instance SetAuthorizationCodeToResponseContext has tackled the non-null requirement by setting an empty Scope object value to the claims set when scope has been absent in the authorization request. But obviously it should simply use null instead after the claims set allows it.