XP

Whenever you link your google account with another software, you will be promoted to confirm that you are enabling them to access certain parts of your account. By enabling that program to do a certain task, you've created a token that can be used to confirm that they are indeed allowed to do that task.

YouTube has been somewhat compromised. There are channels that can hijack your account if you reply to one of their comments or subscribe to their channel. From what I've heard, this mainly affects people who have YouTube channels as there are 3rd party programs available to assist you in creating content. Those programs require almost complete access to your accounts making them able to basically delete your whole channel.

What's stolen is most likely the token that tells YouTube that they have permission to use your account however they see fit. Your account will then most likely be added to a list of bots which can be used to boost the views and statistics on the hacker's account.

Your account could already be compromised and you wouldn't even realize it. They can easily get past complex passwords and even 2 factor authentication.