I could've sworn you had some granular level of control as far as what the apps are allowed to do when they access your Gmail account, e.g. Reading emails only versus read/reply/compose, etc. Maybe I'm thinking of OAuth.

For some reason I also thought there was some way of tying the app's identity to the password, such that if an app other than Thunderbird tried to use my Gmail Thunderbird-app password, Gmail would block it. But I'm probably wrong on that point.

Would be a great enhancement, if not.