If you use a password manager with different passwords for each site it doesn't matter (much). Either they steal your password (usually hashed), or your OAuth i

If you use a password manager with different passwords for each site it doesn't matter (much). Either they steal your password (usually hashed), or your OAuth information. The minor difference is that with OAuth they cannot log-in to the site pretending to be you, but if they don't hash the passwords, or use weak method to do it, then it's possible. Regarding other user data stored in the DB (which is usually more valuable than just the passwords) there is no difference between the login method.