This actually brings up a point that was made in a cambridge analytica post. If personal information is deleted after it has already trained a dimension-reducing model, is it really deleted?

If Google and Facebook see everything because of oauth, we can ask them what data they have and tell them to delete it, but they won't be deleting whatever models they've been training about us.

OpenID Connect exists, it allows OAuth from and to unrelated services.

Neither Google nor Facebook own Oauth, they just have very incompliant implementations that force everyone to treat them as special.