If the "third party" is actually a malicious native application, they can just simulate the launch of Safari, and most users probably won't even notice.

In this threat model, OAuth is practically a security no-op and a huge usability negative.