not only this. also all other privileges (contacts, gmail, analytics) you've shared with apps (maybe you don't).

I'm not naive enough to think that Google is looking out for the little guy in the privacy arena, but I assume this isn't the default (opt-out) behavior. Anyone have an authoritative link on this topic?

No, they don't give any permissions with OpenID. This page lists both OpenID and OAuth-using services. For an example of a service that uses OAuth, try LaTeX Lab (http://docs.latexlab.org/), which uses OAuth to get access to your Google Docs.