You only get the refresh token if you ask for it explicitly with
scope = refresh_token and your flow meets other documented constraints such as custom protocol on the callback URL. We agree that this "extension" is not compliant with implicit grant type spec. If memory serves, it was created by SF for mobile apps a while ago. While some might still be using it, it's more or less a legacy option as of now.
Implicit grant is no longer recommended. From oAuth Security BCP:
The implicit grant (response type "token") and other response types
causing the authorization server to issue access tokens in the
authorization response are vulnerable to access token leakage and
access token replay
The BCP goes on to say you might be able to use it if you mitigate certain issues and Salesforce helps you with some of this by e.g. enforcing same-origin on user agent. Still, the threat model is extensive and mitigation strategies are fragile. Thus, the authorization code grant with PKCE is the recommended way to go nowadays for any public client, native mobile or browser-based.