This makes me quite annoyed as well. Whenever I've asked Twitter about it, they simply say "The applications still use an OAuth access token to access the API,

This makes me quite annoyed as well. Whenever I've asked Twitter about it, they simply say "The applications still use an OAuth access token to access the API, so it's still a secure authentication option." That's not the problem. The application may have to use the access token to use the API, but there's absolutely nothing stopping them from storing the password in their databases behind the scenes.