They can host their own.
I don't understand why they would trust <crappy forum owner> over a dedicated authentication storage place but that's their choice. And yes, there is also every possibility to offer direct credentials, per the Stack Exchange model (they host their own oAuth server and allow simple registrations).
What if <crappy forum owner> happens to be a security engineer, and <crappy forum> happens to be Silk Road 13?
The trust decisions people make are situational and nuanced. OAuth is great if that's where people invest their trust. Otherwise, you're outsourcing it for the user to a company they might fear.
1. Let every website on the Internet potentially be an OAuth provider.
2. Make OAuth optional.
If you follow option #2, then this article is still relevant because you need to handle passwords securely.
Secondly, every website on the Internet is potentially an OAuth provider.
Not to mention that I have —on multiple occasions here— suggested that websites that consume OAuth should also provide it (like Stack Exchange).