This is status-bydesign.
You'll note on the authentication documentation:
Desktop applications cannot participate directly in OAuth 2.0 flows,
however the embeddable browser controls available in most frameworks
make it possible to work around this limitation.
Desktop applications should use the implicit client-side flow, hosting
the process within a browser control. For redirect_uri, a value of
https://stackexchange.com/oauth/login_success should be used. Upon a
successful authentication, access_token will be placed in the url hash
as with a standard implicit authentication.
However, I can see that some developers may want the peace of mind that comes from this not being available.
You can now disable this behavior on your application's edit page.