For new Apps it is mandatory, existing apps have until April of next year to support it before updates will start getting rejected.

Only mandatory if you use Facebook/google sign in.

Any third party sign-in.

Yeah, sorry, was over generalizing it. They did make that first-party exclusion for SSO thankfully.

My understanding is that critical bugs pushed back the implementation deadline even for existing applications.