There is a security reason why this setting exists the way it does. It's kinda complicated, but explained in the PR which introduced PKCE. Find that on Github if you want to know the nitty-gritty. But it's really not interesting to users I suspect. To answer your initial question: forcing PKCE should not be necessary. Providers which support autodiscovery will use it automatically. The security improvement for providers which do support it but don't advertise it is low.

In case you are interested: There is a niche use case where having the provider ID and/or organization ID as part of the redirect URI is problematic. If for any reason you can only whitelist one redirect URI at the provider side for your OAuth2 client but absolutely must use that OAuth client for multiple OIDC connections in Ory, this flag comes to the rescue. You can whitelist a generic URL without a reference to the organization ID or OIDC provider ID. In order to make that secure, though, we must use PKCE for that client. So in order to support that use case but make a misconfiguration impossible, the two things are tied together via

pkce: force

.