The call to get the access token happens in the back channel, so an attacker that’s sitting in the browser or camping on the redirect URIs will never see the back-channel call.