Very few people want to interface with a wearable locally and store the data locally (esp via a mobile app given the use case here).
I have spent my entire career messing around with APIs and platforms and I have no interest in doing this DIY. oAuth into Oura ring's servers, which is totally available to you, is just fine.
If privacy is this much of a concern, why wear a trackable wearable in the first place?
You seem to have some very peculiar definition of "work". To display time, maybe? I don't think I need to buy a $800 fitness watch for that. And you cannot export any data without "connecting". Hell, you cannot really do that after connecting too, except to download each gpx track manually via very unfriely interface, or, if you happen to be European, find a very well hidden GDPR-compliance form on a separate site to request export of your data, which you'll receive (in up to 3 days, they warn you) on your email in very user-unfriendly format, without any docs or APIs on how to process it. And you need to be their business-partner (like Strava, I suppose) to actually get access to any APIs.
Possibly peculiar for you. If you don't find value in maintaining your privacy, there's no reason to put others down that try.
In any case garmin watches are not all $800.
In comparison, most other devices require activation to work. Have you tried to use an apple watch or a fitbit?
I have a garmin watch, have never used bluetooth, wifi, garmin connect, etc.
It keeps track of my health and activities, motivates and makes recommendations. It's really useful to track sleep and fitness level.
The only local thing it does not do is EKG, they lock that until you go online and give your location as in the US.
Oura could provide their app, but also make it possible to talk to the ring directly via Bluetooth. Not only would this solve the privacy issues, but it would make third-party apps more reliable (due to no more round-trip).
The amount of work Oura would need to do would be trivial: they'd need to provide a basic description of the format of the packets the ring sends over Bluetooth (or just release protocol headers/internal client libraries). They'd also need to not put in work to deliberately prevent other apps from connecting (which some manufacturers do; not sure about Oura).
You are still at the whim of the company, who can turn off that data spigot any time it becomes expedient for them.
There's no way to get the data off of the device and use it yourself, without the same data going to their servers.
You pay hundreds of dollars for a device that doesn't let you use it, and rely on the kindness of the company to know your own heartrate.