Presumably "abusing" OAuth means they've just extracted the client ID and client secret from the official app, thus pretending to be the official app to the API

Presumably "abusing" OAuth means they've just extracted the client ID and client secret from the official app, thus pretending to be the official app to the API. There's no other way to "abuse" OAuth other than pretending to be an already-authorized client, and obtaining that authorization still ultimately relies on getting the user's username & password and would only be limited to what the client you're impersonating is allowed to access.