Here is a short list of things that Play Services do:
- Scan for active malware
- Nearby Share
- App attestation (Required for banking apps)
- Encrypted backup of your data
- Autofill
- All push notifications
- Find my device
- Basic telemetry (talked about elsewhere in this thread but it's telling Google who you are and where you are)
Even if you remove all telemetry you'd need to have the services running 24/7 in the background maintaining a socket connection to push notification services.
If someone has the email account password your security is already fucked. If they don't then there's no way to pop your oauth unless the client is shit. If the client is shit you shouldn't give it your credentials.
SSO is not a security vuln.