Are these "application-specific" passwords limited in any way? For example, if one of them is stolen without my knowledge, can the attacker fully access my Google account (e.g. account settings, all Google services, etc.)? Obviously it's less likely that one of these passwords will be stolen than passwords, but it's still possible.

From the screenshots (don't have access yet) it seems that you don't get to specify the type of application or access, but I would assume there is some limitation on what you can do with these passwords?