This is what I've garnered from the replies here...
OpenID is only as secure as the parties involved and that is true of any authentication method. I realized that before I started this discussion.
The issue with OpenID, as it seems to me is two-fold...
Your LoginID is no longer a secret shared only between you and the site you use it on. It is your OpenID and is known by every site you use it on, and is something easily guessable like an email address or something derived from your email address or something similar.
RP's may implement OpenIP on their site without doing due diligence assuming that because they are using a widely accepted 'protocol' that it is secure. Granted, most run-of-the-mill web site developers have no true concept of how to secure a site but, if they implement their own security, at least issue #1 doesn't come into play.
As a consumer, When I create an account on any-site.com, I have no notion of the intelligence of the developers / site managers. I use an ID that I don't think will be easily guessable. I don't want serverfault.com to know the ID I use to login to Etrade.com. I also use a different password on every site and manage those passwords with my own scheme. It is highly unlikely that my account will be comprised unless the site operatores are total idiots.
With OpenID, everyone in the WEB knows how it works and how to attack it, should the RP not have proper measures in place.
I love open source software, but in the case of OpenID I think it opens up the possibility that there will be inferior implementations available to unsuspecting adopters.
I think this could be all solved by some signed seal of approval that assures the consumer that the site has passed an audit and is not vurnurable to hacks.
Maybe I'm just paranoid.