The Google implementation of application specific passwords is horrible. There's nothing application specific about it -- it's valid for at least mail, calendar, and contacts, with no way to limit the scope. It ends up being a password that effectively bypasses all MFA on your Google account. Where do you store such a password? That's a powerful credential to be regularly unlocking.

I should be able to create a credential that's valid for just SMTP, with no IMAP or cal/card access at all.