The watch crystal is fine.
The resistor limits the power to the crystal. If you look at the datasheet you'll see maximum drive level is 1 µW, for other crystals it's even 0.5 µW. So I wouldn't decrease the value or you may destroy the crystal. The drive level is different for each manufacturer, so there's no solid rule for the resistor's value. I would follow Microchip's advice.
A larger value may look even safer, but then the power will be too low, and there's the chance that the oscillator won't start. At 20 MΩ that will definitely be the case.
Isn't it possible that the MΩ resistors you saw were between output and input of the oscillator?
Yes, all microcontrollers have some way to produce voltage signals controlled by the firmware. The brute force method is for the micro to include a digital to analog converter (D/A). The firmware writes a number to the D/A and it produces a voltage proportional to that number.
One important spec of D/As is how many bits the number has. This determines its resolution. The D/A can produce 2N different values when there are N bits in the number. For example, a 8 bit D/A can produce 256 different voltage levels. Note that a ordinary digital output pin can be thought of as a 1 bit D/A. The number has two states, 0 and 1, and the output voltage is either high or low.
Most micros don't come with multi-bit D/As built in because there is little demand for this. Usually we try to convert analog values to digital as early in the process as possible, do the manipulations digitally, then control things with pulses. It is unusual to want a micro to produce a analog voltage. Even in applications like audio that you may think of as being inherently about a analog signal, things are often handled digitally or with pulses at the end. That's basically what a class D amplifier is.
If you don't want to use one of the limited set of micros that have a D/A built in, you can add one externally. There are many D/As available that the micro can drive over a SPI bus, for example.
However, unless you need high speed output, low pass filtering the PWM output of a micro results in a nice analog signal. Micros are good at producing well controlled sequences of pulses, and many have hardware built in for this purpose. For example, consider a digital output that can be changed every 1 µs (at 1 MHz rate). Suppose you grouped the 1 µs time slices into blocks of 1023. For each block, you can have anywhere from 0 to 1023 of the slices being high. If you were to average this, you'd get a analog value with 1024 possible levels, which is what you'd get from a 10 bit D/A. The raw signal will contain the average value you want, plus high frequencies starting at 1 MHz / 1023 = 978 Hz. By applying a few poles of low pass filtering (one resistor and capacitor per pole), you can keep the low frequency average signal and get rid of 978 Hz and higher components.
This type of A/D has some nice properties in that it is very linear, monotonic, and no power of two glitch outputs. The only drawback is usually bandwidth. For a few simple resistors and capacitors forming the low pass filter, you probably can't get a analog signal faster then a few 10s of Hz.
Note that using 1023 slices per block was a arbitary choice you made. If you want more resolution, make the blocks bigger, but then the filtered output will have to change slower. However, lots of micros can do the PWM generation in hardware with much faster than a 1 MHz slice rate.
I would try to see if the PWM method can be made to work before going to a external D/A.
Best Answer
The answer is two fold:
Firstly - pull up resistors are enabled by default on all input ports when WPUEN# in OPTION_REG is cleared. This will affect analog inputs like VREF+ and may affect analog outputs like DACOUT. I'm not certain on the last point as I have not tested that assertion - it seems wrong on the face of it though. This is true for the PIC16F1825 but may not be true for other PIC micros in other ranges.
Secondly - the DACOUT and VREF+ pins are, on this micro, shared with the PGD and PGC pins. If a PICKIT3 is connected, that device has 4k7 pull down resistors on both these pins.
If using VREF+ or DACOUT, make sure pullups are disabled and the PICKIT3 is disconnected.