Worse than that. You are at the mercy of what service providers think of both them AND all of their clients.

Suppose that they have a customer who uses their service to install malware in people's accounts, and Google catches them. Google isn't going to just shut off one customer. They are going to revoke the client_id associated with OAuth.io, causing every customer to lose access. (A malware author could try this because they would hope that malicious requests are more easily lost inside the torrent of other stuff coming from OAuth.io.)

And it isn't just a customer who is intentionally bad. If a customer gets compromised by a malware author who uses that as a vector, well, same story.

You do not want your access to business-critical APIs to depend on a third party reseller who cannot guarantee their own continued access. Really.