Don't websites usually create an association between a local user (in their DB) and an oauth2 account, linked by the email address? And then all your data is li

Don't websites usually create an association between a local user (in their DB) and an oauth2 account, linked by the email address? And then all your data is linked to the local DB user. I guess it's a bigger threat if you don't use your own domain for email. EDIT: I'm talking about sites that also have their own local user db of course, so you could just do a password reset.