I understand that OAuth is not an authentication protocol, but an authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that:
[...] authorization can be abused into some pseudo-authentication, on the basis that if entity A obtains from B an access key through OAuth, and shows it to server S, then server S may infer that B authenticated A before granting the access key.
and that I should use OpenID when I need to authenticate a user.
However, does it mean that if I actually use OAuth (not OpenID Connect, but OAuth 2.0) with Google, does it mean that my web application is not secure? Can it be compromised to gain access to an account or do something wrong? Can a user forge something to pass for another user?
To make the question a bit less abstract, let's assume that:
The libraries I use, such as
Flask-OAuthfor Python and similar libraries for other languages, are secure.
I trust Google,
Google account of a user is not compromised (if user's Google account is compromised, an attacker is indeed expected to have access to the user's account on my web application),
The FAI/hosting service/other man in the middle should not be trusted,
Anyone who has a Google account can login/register/whatever,
I don't need the user's e-mail address, first/last name or other personal information to be true; all I need is to keep data of one user protected from other users.