It's common to compose the OAuth2TokenValidator<Jwt> defaults with additional validators. Here is an example from Spring Security:

class DefaultOidcIdTokenValidatorFactory implements Function<ClientRegistration, OAuth2TokenValidator<Jwt>> {

    @Override
    public OAuth2TokenValidator<Jwt> apply(ClientRegistration clientRegistration) {
        return new DelegatingOAuth2TokenValidator<>(new JwtTimestampValidator(),
                new OidcIdTokenValidator(clientRegistration));
    }

}

This could change to:

class DefaultOidcIdTokenValidatorFactory implements Function<ClientRegistration, OAuth2TokenValidator<Jwt>> {

    @Override
    public OAuth2TokenValidator<Jwt> apply(ClientRegistration clientRegistration) {
        return JwtValidators.createDefaultWithValidators(new OidcIdTokenValidator(clientRegistration));
    }

}

This convenience makes it simpler for applications to base their validation on the already-vetted Spring Security defaults, making applications more secure.