There is a small additional wrinkle to Tim Cross' excellent summary:

On Sat, May 7, 2022 at 12:17 AM Tim Cross <theophilusx@gmail.com> wrote:

>
> 2. Use a Google oauth2 compliant client to obtain an oath2 access token
> which you then use as your password in your libre IMAP/SMTP client.
> However, at this time, there doesn't seem to be any libre Google oauth2
> client we can use. If there was, it would be theoretically possible to
> access your emails and send new ones using only libre software and avoid
> needing to login to the non-free settings page to setup application
> passwords.


There exist libre mail client software packages that use oauth2 to talk to
Google/Gmail. For example, nmh, which can be used inside emacs with mh-e.
That said, these packages have practical downsides to pure libre usage,
including both Thunderbird-style "we think we know what you mean" reading
of the terms and conditions as well as user-setup instructions that include
running probably non-libre Google javascript.

In the end, it would be great if the FSF (or someone else) could get Google
to go "on the record" about the details of the Terms & Conditions, but
that's been the state for several years now, and it doesn't seem likely.
(In fact, it's a common refrain among frequent gmail users running Chrome,
Android, and iOS apps that gmail is basically unresponsive except to
periodically push out undesired changes.) Still, it would be great, hope
springs eternal, etc.

In terms of practical advice for people who want to use emacs and are stuck
at least part-time on gmail (or "Google Workspace", or whatever it's called
this month), the various middleman approaches ala mbsync or davmail are
functional. The main complication there is in trying to automate things
that Google (MS Office 365, etc) design as (frequently changing)
interactive web pages, and the results are often fragile or confusing. I'm
a firm proponent of Hanlon's Razor, but it's hard to believe that this
outcome isn't at least tacitly accepted.

Hope that helps,
~Chad