The default curl timeout for request seems to be 30 seconds. I'd say that, for most cases, this is a bit excessive. Considering that we are increasingly connecting Moodle to other systems and services behind the scenes (consider Google drive, Nextcloud,  but also plugins such as the Opencast block) we need to make sure that trivial things can fail quickly, so that overall loading time is not affected too much.

Right now I have these classes in mind: oauth2_client (extending from curl) and  core\oauth2\rest (using curl as a delegate). There are probably more...

I think these classes should

a) provide easier methods to explicitly reduce the timeout, as an abstraction to CURLOPT_CONNECTTIMEOUT, CURLOPT_TIMEOUT, and
b) use a shorter default (for most things, ~1 second?)

Particularly with respect to a), I think that establishing a connection implicitly (such as obtaining a new access token) could have a timeout of 0.5 seconds, so that the effect on the loading time is lower when the remote server is down. However, when we perform actions on the remote server that are known to be complex, the developer could willingly increase the timeout to 30 seconds or even more.