According to Salesforce, here
"You can use the username-password flow to authorize a client via a connected app that already has the user’s credentials. However, we recommend avoiding this flow because it passes credentials back and forth."
"The OAuth 2.0 user-agent and username-password flows are considered insecure and aren’t recommended.
... In place of the username-password flow, we recommend using OpenID Connect dynamic client registration or the OAuth 2.0 client credentials flow."
"The username-password flow presents security risks. We recommend using the OAuth 2.0 client credentials flow instead."
The OAuth 2.0 Client Credentials Flow documentation then goes on to say:
Sometimes you want to directly share information between two applications without a user getting in the way. For these scenarios, you can use the OAuth 2.0 client credentials flow. In this flow, the client app exchanges its client credentials defined in the connected app—its consumer key and consumer secret—for an access token. This flow eliminates the need for explicit user interaction, though it does require you to specify an integration user to run the integration. You can use this flow as a more secure alternative to the OAuth 2.0 username-password flow.
So, what exactly makes Client Credentials more secure than username-password? Is it just the fact that you can't use the client id/client secret for UI login and that the requesting server doesn't need to securely store login credentials?
If Client Id/Secret are intercepted or otherwise leaked, it feels like it would be just as risky as if username-password for an API-Only user (no UI Access) was intercepted or leaked.
Are there other security benefits to Client Credentials that I'm missing?