A calendar app wants to read your meetings. The old answer was to hand it your password — which also hands it your email, your files, and the ability to change that password. OAuth exists to make that unnecessary, and the app never sees the credential at all.
The flow has five steps. The app sends you to the provider. You log in there, not in the app. You see exactly what is being asked for. The provider hands the app a token. And that token is narrow: scoped to calendar read rather than mail, with a limited lifetime, and revocable without changing anything about yourself.
OpenID Connect sits on top and answers a different question. OAuth asks may this app do that. OIDC asks who is this person — the identity token behind "Sign in with Google".
A leaked token has a clock on it. A leaked password does not.
Delegation done well means handing over one specific capability, not our entire identity.