What are the limits of public clients in OAuth 2.0 -

oauth 2.0 specifies 2 client types:

• public (client_id)
• confidential (client_id:client_secret)

and section 2.2 says:

the client identifier not secret; exposed resource owner , must not used alone client authentication.

while clear me public clients used implicit flow, there more seems. when performing auth code flow, first request authorization endpoint our client_id, no secret required. then, after getting user's consent , authorize code, request token endpoint. according spec, able request endpoint without client_secret:

client_id      required, if client not authenticating      authorization server described in section 3.2.1. 

if client type confidential or client issued client credentials (or assigned other authentication requirements), client must authenticate authorization server described in section 3.2.1.

...

the authorization server must:

... o ensure authorization code issued authenticated   confidential client, or if client public, ensure   code issued "client_id" in request, 

so section says able request endpoint without client secret. now, doesn't refresh tokens other may included in request.

refreshing access token mentions:

because refresh tokens typically long-lasting credentials used request additional access tokens, refresh token bound client issued. if client type confidential or client issued client credentials (or assigned other authentication requirements), client must authenticate authorization server described in section 3.2.1.

so we're allowed refresh access token without client authentication.

now, confuses me implicit flow not allow issuing of refresh tokens:

the authorization server must not issue refresh token.

it doesn't explicitly why can't that, we're not allowed to. reasoning isn't allowed because client can't trusted. since authorize code flow allowed public clients, why need implicit flow, if same thing can achieved public client, plus getting refresh token?

i'd glad if clarify this.