The idea behind OAuth is that as a service you do not need to know the credentials (yet again) in order to authenticate and personalize the service.
You are correct in that the bearer tokens (part of OAuth 2 in fact) are just as sensitive as username/password. but so is a hash of it.
The idea is that with OAuth 2 you authenticate with the OAuth 2 Server-provider, the server than hands you (or in fact the application your authenticating with) a set of tokens to use.
- Bearer token, short lived token to directly use for authenticated requests.
- Refresh token, Long lived token to get a new Bearer token.
The OAuth application uses these together with its own preregistered secrets (Application ID and Application Key) and a TLS connection (https) to keep things secure and secret.
The end result is a scheme that is at least as secure as the login scheme of the OAuth service provider,
without having to maintain a new set of credentials and without having to disclose the credentials to the possible 3rd party that is the OAuth client service.
As a bonus there is no requirement for the client to use TLS and still have a secure login
(although I highly recommend TLS for any web-application myself).
And when 'grants' are used it is possible to limit what information the tokens can be used for,
like facebook, google and github show users that authenticate with oauth.
The following image taken from Wikipedia illustrates how oauth works differently than username/password schemes and why it can be advantageous.