True, we don't have an open way of injecting custom AuthzModule, for OAuth2 implementation I stick to similar design than AGAuthenticator/AGPipeline etc... Like AGAuthenticator, AGAuthorizer is exposed to the client and is in charge of building a AuthzModule with a given configuration (the authz method). We can have different Authz modules but we have to change the code in 
https://github.com/corinnekrych/aerogear-ios/blob/e6d4a15daf172706199aa8f09b00cd31cce7712c/AeroGear-iOS/AeroGear-iOS/security/Authorizer/AGAuthorizer.m#L49

I think this "Pluggability" concern is worth talking in ML as it's not just impacting OAuth implementation. wdyt?