I think this is a bug in 150.0.1 of the googleapis module in npm.

I rolled back to 149.0.0 and no longer have this issue.

I agree with your assessment, that undefined values are being serialized as strings, causing the backend to think it's PKCE.