Interesting. Wouldn’t that allow someone to sign up for service Y with an email address associated with an account in your system using service X, in order to get access to the account in your system?
Maybe there’s something I’m not seeing, but it seems dangerous to rely on the identity provider’s email address to authenticate the user.
It's assumed that, if you're signed up for a service with an email address, you control that email address.
This is generally a reasonable thing to assume, and can be verified for whatever account providers you support.
1. Use the same password for all logins because you don't know how to manage unique passwords for all your logins. Obviously this is about as unsecure as you can get.
2. Write your unique passwords down somewhere. This can be in a notebook, or a password manager (1password and the like). In this case, there is still a single point of failure (as you pointed out) if someone finds your book or compromises your password manager.
3. Use some sort of SSO service. Still a single point of failure (Apple, Google, Facebook).
I feel like using Apple SSO with 2-factor authentication is just as secure as any of these options.
Is there any "secure" system that doesn't have a single point of failure?
If you're looking for a point outside yourself, then memorising all your passwords would be an option.
But beyond that, I don't think your criticism is warranted. There's always a single point of failure - sure - but we can still consider gradations of how centralised that point is, and how likely it is to fail.
With a hosted password manager, you're at the mercy of their server code; specifically, at least for 1password, I think they have a 'dead man's switch' which lets you get at the encrypted content without the master password. This is more likely to fail than a password manager which stores all its content locally and really encrypts it (e.g. keepass). In this case, human error outside of yourself can't compromise you. But technical error can, which is why there are more steps that can meaningfully increase your level of security. Like running your password manager on a separate, air-gapped computer; or sandboxing everything you run a la qubes.
Are any of these especially likely to compromise you, as a user? No, but reducing centralisation and dependency still improve your chances, and are definitely worth considering if you are e.g. running a drug smuggling ring.