If people reuse the same id and password across multiple sites, then cracking one site gives an attacker access to all of their online accounts. Of course not everyone does this and even those who do may not do it for all their accounts but its probably done enough that we have a de facto distributed repository of replicated authentication data - and that is worse than a single logical repository managed by someone that specializes in protecting identifying information.

Larry Seltzer at eWeek , for example, is willing to trust a vendor like Verisign with his OpenID data:

I wouldn't trust just any OpenID provider, but I would trust, for example, VeriSign, which has been in the OpenID provider business from the very early days. VeriSign is high on it, and (for what it's worth) the company even goes to the trouble of putting an EV SSL certificate on the site. Why do I trust VeriSign? I don't know, call me naive, but it runs trusted authentication infrastructure for very big businesses.

In theory I don't like OpenID but in theory we all know how to securely manage authentication information. As someone once said, in theory there is no difference between theory and practice but in practice there is.