WSOD on calling /oci/logon

Problem/Motivation

After upgrading a client which merrily ran 1.2 on D9 to D10 && 1.3, calling the OCI punchout as

https://example.com/oci/logon?username=name@example.com&password=xxxxxxx

yields WSOD. I also tried a login without any credentials, just to see if any of the error messages of the module get 7riggered, i.e.
https://example.com/oci/logon

with the same result. The following message gets logged:

InvalidArgumentException: The controller for URI "/oci/logon" is not callable. in Drupal\Core\Controller\ControllerResolver->getControllerFromDefinition() (line 53 in /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/Controller/ControllerResolver.php).

Steps to reproduce

I upgraded to 1.3 with D9 still installed, and then migrated the site to 10.2

Same also happened with a testing site, with only commerce (latest version) being installed.

The error stack reads like this, but it leaves me without a clue as what is failing here -- it seems "/oci/logon" doesn't resolve:

#0 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/Controller/ControllerResolver.php(65): Drupal\Core\Controller\ControllerResolver->getControllerFromDefinition('\\Drupal\\commerc...', '/oci/logon')
#1 /var/www/web29/htdocs/10/vendor/symfony/http-kernel/HttpKernel.php(164): Drupal\Core\Controller\ControllerResolver->getController(Object(Symfony\Component\HttpFoundation\Request))
#2 /var/www/web29/htdocs/10/vendor/symfony/http-kernel/HttpKernel.php(76): Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object(Symfony\Component\HttpFoundation\Request), 1)
#3 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/Session.php(58): Symfony\Component\HttpKernel\HttpKernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#4 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/KernelPreHandle.php(48): Drupal\Core\StackMiddleware\Session->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#5 /var/www/web29/htdocs/10/web/core/modules/page_cache/src/StackMiddleware/PageCache.php(106): Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#6 /var/www/web29/htdocs/10/web/core/modules/page_cache/src/StackMiddleware/PageCache.php(85): Drupal\page_cache\StackMiddleware\PageCache->pass(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#7 /var/www/web29/htdocs/10/web/core/modules/ban/src/BanMiddleware.php(50): Drupal\page_cache\StackMiddleware\PageCache->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#8 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/ReverseProxyMiddleware.php(48): Drupal\ban\BanMiddleware->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#9 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/NegotiationMiddleware.php(51): Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#10 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/AjaxPageState.php(36): Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#11 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/StackMiddleware/StackedHttpKernel.php(51): Drupal\Core\StackMiddleware\AjaxPageState->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#12 /var/www/web29/htdocs/10/web/core/lib/Drupal/Core/DrupalKernel.php(704): Drupal\Core\StackMiddleware\StackedHttpKernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true)
#13 /var/www/web29/htdocs/10/web/index.php(19): Drupal\Core\DrupalKernel->handle(Object(Symfony\Component\HttpFoundation\Request))
#14 {main}

A scary detail to add after trying to re-install the module:
A simple
$ composer remove drupal/commerce_oci_checkout --dry-run

seems to delete much of the installation -- output of composer:

./composer.json has been updated
Running composer update drupal/commerce_oci_checkout
Loading composer repositories with package information
Updating dependencies                                 
Lock file operations: 0 installs, 0 updates, 3 removals
  - Removing drupal/commerce_cart (2.37.0)
  - Removing drupal/commerce_oci_checkout (1.3.0)
  - Removing drupal/commerce_product (2.37.0)
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 0 updates, 3 removals

Obviously I'm not an expert, but to see two crucial, but in no way related modules being removed with commerce_oci_checkout is a bit scary to me.