I think they're just other smart contacts that use many data sources. Like if you wanted an oracle that returned the result of a baseball game, you'd have it check various newspaper websites and have it make sure the results were all the same. To attack it, you'd have to attack all the newspaper sources. It's still a weak point, but not quite a single point of failure.