Use case: I have an unattended cron task polling my IMAP account to archive the mail every 4 hours. I specifically use an IMAP read-only unique ("per-app") password for that script/connection; under no circumstance should that password have access to write to IMAP, touch POP or SMTP. Fastmail allows me to do this with ease, and I can create as many as I'd like with different ACLs. The mxroute reasoning simply does not consider all the use cases people have and want per-app passwords for to increase their personal security posture.