As others have mentioned, if you need to login to the SMTP server to send, WordPress needs to have access to that login and password to be able to send email. And CMS need to send email to send out password resets, notifications of software needing manual updates, content update notifications, etc.

The issue here is that the login and password to send email is the same as the one to receive email. So, if someone gains access to WordPress and gets that, they can then hit the IMAP server and read all the email associated with that account.

The sending mail account for the server should have been separate form any used by any users. Realistically, it should have also had either a separate password for SMTP vs IMAP or, even better, used a mail spooler of some sort either self-hosted or third party to handle the actual mail sending. I use SendGrid for many of my Drupal installs, for instance.