WebViews Are Not To Be Trusted

You as the user can't tell if the webview is using the HTTPS protocol to request data. You don't have to be a target of the NSA to care about this. If you're at a wifi hotspot with your mobile phone, like at the airport, you can see the clear text requests others on the wifi network are making.

You can see what a form posts to when you submit it in the URL. Browsers will warn you when there is non HTTPS data loaded on an HTTPS page.

Do native apps really use third-party authentication services? That would scare the shit out of me too.

I think the point of the article is that there's a trend with web applications to use third-party identity providers like Google or Facebook. This itself is (mostly) harmless; their login procedures are designed so that you can verify that it is, in fact, Google or Facebook you are logging into, because the login form is hosted on their domain, it goes through SSL, and you can verify all that in the browser's address bar.

There's also a trend toward eliminating the address bar, by eg. putting your webapp in a WebView which doesn't show it, or by using native-only apps, or Chrome's move toward not showing the full URL for certain sites. When you combine this with the trend toward third-party identity providers, it's very dangerous, because you have no way of verifying that you are giving your identity to the people you think you are giving your identity to.