There are 2 issues being raised here. Firstly, Facebook Connect keeps people logged into Facebook once they've logged out of then authentication consumer site. From the user's perspective, this may be desirable behavior or not. If it's their personal desktop and they like to leave themselves logged in to Facebook then it is. If it's a shared PC at an Internet cafe, probably not. As part of the Connect API, Facebook could force the authentication consumer site to ask at the time of logout and to propagate through.

The second issue is that of honeypots and tricking people into providing credentials. People very seldom check the URL to verify that Facebook or Twitter are the actual sites that the data is being submitted to. In fact, they've been trained to do that with services like Mastercard Securecode usually implemented inside a frame to "arcot.com". This is a much bigger issue that requires a more imaginative solution.