I'm not making excuses for the big companies -- I'm just trying to evaluate the challenges properly. If the core of the problem really is the behaviors of 3p apps, the security model for them is what a solution needs to address.
Yes, facebook and other social platforms have issues with people snagging account access, usually by shared password vectors, but come on.
This is still basic meat and potatoes auth for a more open social "pan-platform".
Regardless of how you feel about it, the Cambridge Analytica ordeal was entirely about using benign quiz apps to mine user data, and the pressure that Facebook received was to fix their security. That's a huge incentive to lock down fair access. So if this is the situation, we need to address it if we're going to fix the technical pressures that create monopolies.
Facebook's issues stems from the fact they allowed apps in their market to access data they didn't need to function / hide exactly how much access these applications are granted.
the reality here is auth is the solution; for browser extensions we need better UX. if a extension is asking for access to your navigation / page data that needs to be flagged and warned about during the setup flow.
many of these auth systems make the risky API access grants appear extremely benign.