OAuth is used to authenticate the App such that SharePoint can enforce the permission for the App.
So when using an App there are two sets of permission in action:
- The permission of the current user
- By default the user has the same permission on the host-web and app-web due to the app-web inheriting permissions
- The permission of the App
- By default the App has full control of on the App-web
- The only permissions the App has on the Host-web are the ones specified in the App Manifest and granted by the person installing the app (which is required to have these permission herself)
When SharePoint calls an App it'll pass a token which allows the App to get a token identifying itself and the current user. In case of a non SharePoint hosted app it may also request a token identifying only the app with no user (requires that this was requested in app manifest)
All access checks in SharePoint will the check that both the App and the current user (unless app only token) has permission to do what is requested. If either fails the app get access denied.
This means that even though the current user is Farm Admin, the app only has the permission on the Host-web that it requested, which is a lot safer that Farm Solutions.
The App only token (not for SharePoint hosted apps as it requires server side code) then allows the app to do actions on the Host-web even though the current user doesn't have these permission, which is something we lacked in Sandboxed solutions.