Who verifies the data coming from first party oracles?

I have been reading up on API3 and if I am not mistaken one of their distinguishing features that sets it apart from Chain.Link is the idea of 1st party oracles. Which I understand to mean the owner of the data, originate the data themselves unto the blockchain.

My question is, who verifies such 1st oracle service? Like what is stopping such 1st oracle service to collude with some other players to modify, or even delay publication of data in such a way to be beneficial to the party they are colluding with?

My understanding is this is difficult, in theory, to do with 3rd party oracles like Chain.Link since the data are independently sought and then aggregated