oauth only passes back a “login successful” reply and an identifier to associate an account with

Right, it’s a unique login token the website or app uses to ID you, and it keeps you logged in as long as you don’t delete the associated cookie. In addition, it can be revoked by you at any time, essentially logging you out (including anyone who may have stolen your cookie and is using it to impersonate you).

It’s better than using the same password everywhere, but not as good as using a password manager with unique passwords for every app and website.