any phishing email could just directly link to a fake Google login form. Oauth just adds extra steps for the attacker.