That magic password is somewhat restricted as in you can only link an application with it once (which then should get an infinite token). It's mildly better. Last time I used it there were scoping options, but I might be mistaken
The magic password is the token. The "scoping" options are just a label (I suppose this might have recently changed), mostly targeting folks who are looking at using legacy mail/cal/card clients with only user/pass support, and are unsure what's going on.
edit: Just triple checked -- the 16 character string returned when creating a "Calendar on iPhone" password works perfectly for SMTP via PLAIN over TLS.