When you use a mobile app that needs Google OAuth login, you can't fully trust the third party app because you can't tell what url the webview is using. Who knows if they aren't storing my login and password on their server, then passing it to Google OAuth.
Does changing your password immediately after OAuth login help reduce risk somewhat? If I understand correctly, the third party would still have their token for limited API access, but at least not the master password to my Google account (even if they are storing it improperly).
On a related note: On Android, I didn't have to login again for OAuth for a third party app, I could just select the Google account that was already registered on the phone. But on iOS, the third party apps I used required a Google OAuth login via webview. Is it possible for iOS apps to have the "integrated" OAuth without login?