In OAuth 2 some grant type combinations are insecure, that’s why we decided for IdentityServer3 that we’ll be defensive and allow only a single grant type per client.
During the last two years of implementing OAuth 2, it turned out that certain combinations of grant types actually do make sense and we adjusted IdentityServer3 to accommodate a couple of those scenarios. But there were still some common cases that either required you to create multiple client configurations for the same logical client – or configuration became a bit messy.
We fixed that in IdentityServer4 – we now allow almost all combinations of grant types for a single client – including the standard ones and extension grants that you add yourself.
We still check that the combination you choose will not result in a security problem – so we haven’t compromised security. Just made the configuration more flexible and easier to use.
See all the details here.
leastprivilege.com 
Hi Dominick .
I’m trying to understand the difference beetween IdentityServer3 and IdentityServer4.
For what I understood the only two difference are the following:
– IdentityServer4 works with .NET Core and IdentityServer 3 don’t
– IdentityServer4 allow multiple grant type for one client and IdentityServer3 don’t
There are other difference?
There is one reason that I would use IdentityServer4 instead of 3 other than works with .NET Core and have multiple grant type?
Thank you.
see also here
https://identityserver4.readthedocs.io/en/release/misc/blogs.html