pull down to refresh

Perhaps. I just don't think people care enough about this. Existing paid auth models are way easier and entire ecosystems need to support 402 for it to be meaningful.
It's really a chicken and egg problem honestly.