So I really hope Google et. al. will offer some kind of email address cloaking like Apple do with their private relay stuff. Knowing Google, they sure as heck won't, though.
An application/site can optionally request the "email" scope during OpenID Connect sign-in, but if it is not requested (only the "openid" scope instead) then the provider must not return an email address in the ID token, or an OAuth access token which is authorized for an API method which returns the user's email address (OpenID Connect Core 1.0 section 5.4 - "Requesting Claims using Scope Values").
Google implement this (https://developers.google.com/identity/protocols/oauth2/open...), by returning only a unique numeric user ID in the returned id_token. I haven't checked other OpenID Connect providers.
I didn't know the details about different scopes and had always assumed the sites would obtain at least the name and email address, because all I ever saw was the prompt "To continue, Google will share your name, email address, language preference, and profile picture with <site>."