What are the implications of letting oauth2 users change their email addresses?

Yeah secondary email should work here, I am not sure though of the implications here. You may not want to fiddle with the primary emails. Maybe give it a shot and see what happens?