The part where you guarantee to your users that the person you authenticated is who they seem to be. In this particular example: "Is this invoice I'm about to pay for the service I purchased, or is it fraud?"
Farming that responsibility off to Google or Facebook and letting them handle the edge cases (for free, I might add) has genuine security value.
No, it’s not.
It’s certainly not harder or more complicated than the OAuth protocol used support Google-based sign-in.
Exactly what unique value do you believe these big companies bring, exactly?