It opens a google sign-in window within thunderbird for me. Interesting.

How does this work? Like, in practice I understand how you open the default web browser and log in, and get an oauth token. But how does the default browser hand it back to thunderbird or whatever application made the request? Is there a standard way for a browser to return a value to an application that called it?

So app passwords are something Google are slowly boiling the frog on to get rid of. As of the last year or two, Thunderbird is using OAuth2.

_The way it does OAuth_, is by opening a google sign in in an embedded browser, and then catching the API key in the redirect by intercepting the navigation in the embedded browser.

It's not a browser session cookie, but it does require the user to log in. To replace this and use the desktop browser, thunderbird would have to spin up a web server, and I'm not sure what restrictions Google have about TLS on redirect targets, which may be problematic to spin up a trusted TLS server on arbitrary end user devices.

They could of course set up a centralised service to echo the token back to end users, but this seems likely to be even higher risk of the service stealing your oauth tokens and less trusted by those types of users still using a desktop email client.