"application-specific passwords" are not actually restricted to a single application. You can restrict the scope (only has access to your emails, for example), but any application could use this password to access your emails.