If the redirect URI is registered and compared by the Authorization server as required by the OAuth2 and OpenID Connect specifications this is not a issue.
The OAuth 2 implicit flow encodes the access token in the URI fragment to prevent leaking in referrer or 302 redirects.
It seems that the person who discovered this Facebook vulnerability somehow broke fragment processing in there browser to make there YouTube video work.
I will say that ESPN went to a lot of work to create a open redirector that preserved query parameters from the origin URI, you don't see that every day. So if anything the discoverer should get some credit for finding a ESPN issue, but it is not more general than that and could not be used to exploit Facebook unless used in combination with some other browser bug to turn of fragment processing in the browser.
I know several Gov projects using it that are quite happy.