How hard it is to move to using OIDC with commonly implemented features such as SSO, anomaly detection, passwordless login, app based MFA, etc?

It's good enough for major financial institutions and available as a service using any number of providers (like Okta, AWS Cognito, Auth0).

I love Valve and Steam but their game launcher client (Steam) lives in the stone age when it comes to use of technologies.

That said, it's far better than the competition so I am still happy, but it is still annoying.