What are the security challenges that these services face?
At the end of the day the client (usually a browser) still needs a token to maintain a session (usually with a cookie variable). If the attacker gets this token, by XSS or OWASP A9 then they can access the same resources. CSRF is also a concern.
Now this is assuming that these authentication providers are totally immune from attack. If a flaw exists in one of these services, you are also in trouble. SQL Injection, Phishing, Insecure backups, lack of brute force protection are just a few concerns.
oauzz is an oauth fuzzer, which can uncover serious flaws in an oauth implementation.