So ... some third-party services implicitly trust the auth data their own apps send them, without verifying the auth data with Facebook/Google/etc. servers from their server-side code.

TL;DR: Some services forgot the "never trust client-sent data!" rule.