Edmund Edgar from Reality Keys here. A good example of Reality Keys in use is EtherOpt, which is a decentralized options exchange. You can see their source code here.
You're right that using an oracle fundamentally requires some kind of trust in the oracle, and avoiding this kind of trust is one of the main reasons for using blockchains in the first place.
This implies the standard "Trusted third parties are security holes" vulnerability: If Reality Keys is hacked or successfully bribed, the wrong people will get paid by EtherOpt. The history of trusted parties in crypto-currency is that our trusted third parties often do get hacked (or "hacked", it's hard to say) so this isn't a purely academic concern.
The obvious mitigation is to combine multiple oracles, as it's less likely that all will be compromised simultaneously. This is very valuable and greatly reduces the risk, although not quite as much as it might sound, because the oracle risk is somewhat correlated; For example, if there's a serious zero-day in some core piece of free infrastructure like SSH, it increases the chance that both Thomas and us will be hacked simultaneously. Also, if one of your oracles is compromised, that increases the value of a successful attack on the remaining ones.
An interesting approach that Thomas has been working on is to use TLS notarization to prove cryptographically that the data he's reporting is what was published by published by the HTTPS site he got it from. IMHO this is currently mainly developer pr0n rather than actual security, because contracts can't actually check the proof, so all you do is get to satisfy yourself that he's been compromised, but since oracle data is generally public and somebody generally has a stake in each outcome and an incentive to scream blue murder if they're robbed, that solves a problem that we never really had, without solving the one we do have: If he gets hacked, you lose your money.
It becomes more interesting if and when Ethereum does a hard fork that will allow contracts to verify the proofs directly; However, even there what you're really doing is moving the oracle: You wouldn't need to trust me or Thomas to provide the right data, but you do need to trust the original data provider to provide the right data. The advantage of this over trusting me or Thomas is that the feed provider may be a bigger company with a brand to protect. However, there are still serious risks, particularly if the data provider isn't really intending for it to be used in the way we're using it, in which case they may fail to secure it appropriately or just yank the API keys your contract needs to access their feed...