I think for the default case the /logout route does the correct thing; log out this specific client only (so the token that is used in the request), but requires a redirect to do so.
There's often a "log out all devices/close all sessions" button somewhere in the settings, but that's not the typical usecase I think.
For SSO I suppose we would want to revoke all tokens that belong to the same session somehow (e.g. kolab4, roundcube, nextcloud, whatever else is integrated), but I'm not sure how they are grouped together atm; I think we would only want to revoke tokens from the same device (e.g. I wouldn't expect to be logged out on the phone when I log out on the computer).