In this diagram the access token request is sent to the FHIR server but the access token response originates from the authorization server. Am I missing something about how the FHIR server and authorization server communicate the response, or is this an error in the diagram?

It's a bug in the "request" line, and a very long standing bug that has survived multiple ballots.

Fix pre-applied in https://github.com/HL7/smart-app-launch/commit/e1c36102b5c07c49c2a6d05231ceff52f9f0c140