Why are the Implicit grant and Password grant discouraged in modern OAuth2 (OAuth 2.1)?

The Implicit grant returns the access token directly in the URL fragment, exposing it to browser history and referrer leaks with no proof-of-possession — Authorization Code + PKCE achieves the same goal more safely. The Password grant requires the client to directly collect the user's actual credentials, defeating OAuth2's core purpose of never exposing the user's password to the client application; both are removed in the OAuth 2.1 specification.