Large companies like Google and Facebook have a reputation to lose.
Considering their scale of operation, there is not much to gain by breaking into the account of some user on some other website. But should they do it and get caught, it would be quite a scandal which would severely hurt their reputation and make their users question their trustworthiness.
People already put quite a lot of trust into companies like Facebook and Google. Most users of their services are aware by now that these companies data-mine every click they make. And they are aware that these companies know more about them than they know about themselves. And these users are perfectly OK with it because they trust these companies to only use that knowledge for content recommendation and advertisement targeting, not for destroying their life. If they already put that much trust in them, also trusting them as an authorization provider for other service isn't a large step.
Personally I never use OpenID with an authentication provider which is not affiliated with the website I am logging into. Not only because I don't trust most of the websites frequently used as authentication providers, but also because the website I log into doesn't need to know if and which identities I have on other websites. But I am aware that my standard of privacy is higher than that of most people.