The way I understand it, the whole concept of OAuth/SSO involves allowing a user the ability to have a central password they can use on a multitude of sites without compromising it because really they're signing into the service hosting their password.
Now, barring the use of two-factor authentication, as the average user does not use this feature, and using Google's SSO feature as an example, but realizing this applies to every similar service:
What stops me from writing an app that simply informs a user that we support sign in with Google and instead of redirecting them to the appropriate SSO page, I just provide a place for their Google username and password. I then emulate the user and authorize my app through the normal SSO process behind the scenes so nothing looks abnormal, and also store their Google username and password on my private server for malicious purpose later?
And if the answer is nothing would stop me, then why isn't 2 factor authentication mandatory on all these implementations?