I think the bigger risk with this model is single companies acting as SSO proxies (to simplify the management of all this) and shifting risk from Google/Faceboo

I think the bigger risk with this model is single companies acting as SSO proxies (to simplify the management of all this) and shifting risk from Google/Facebook holding credentials to $insertEntityHere.