No mention of how this affects POP/IMAP access. I guess this really only helps if you only use web access on all your devices, otherwise the attacker simply accesses your account through POP or IMAP.
You create unique passwords for each program you use within your account settings. You have a list of all of the accounts, and you can revoke the token at any time
I live in China, I dont want to tie my email to my phone number because my phone number is tied to my real identity( requirement to get a phone number here).
Can I opt out of this?
You have to opt in.
It's opt-in.
I would love a key, certificate, or fob based system. But as I learned while living in Japan, any verification method which depends on your home-country mobile phone is a bad idea.