All of the points you've made about poor SSL security could just as easily be made against software that communicate over SSL using a username and password. At

All of the points you've made about poor SSL security could just as easily be made against software that communicate over SSL using a username and password. At least with OAuth, there's only potential for a username/password leak on sign in—after that only the revokable token could be leaked.