Properties are statically sets on portal_oauth directly with classes define in OAuthTool.py. This prevents migration to ZODB Components as erp5_oauth could not be upgraded anymore (chicken & egg issue: we need these classes portal_templates.download() (importFile(portal_oauth.xml)) but they are not available until the bt5 is installed...).
Considering that several properties are supposed to be private but statically set in OAuthTool.py (and it seems there is no way to change them), and that this code has never been used since its introduction 9 years ago, I think it is better remove that code than trying to fix it properly.
@nexedi @aurel Is that ok with you? (All Unit Tests pass) I will wait a few days for anyone to reply and then merge.