Official documentation and some SFSE answers advise against the use of Username + Password flow (Resource Owner Password Credentials Grant in oauth). The JWT Bearer flow is also recommended as a system-to-system authentication mechanism. See:
This makes sense in cases where human users are involved. However, in the case of a server-to-server integration where the communication occurs w/out user interaction and where an api-only integration-specific user is set up in Salesforce to control access, is there a benefit to using JWT Bearer Flow over a Username + Password flow?
It would appear that in some ways, the Username + Password flow would reduce risk exposure since it's limited to a single user where JWT Bearer Flow could potentially expose all users with the pre-authorized profile/permset.