IMAP and POP3 on Office365 will stop working 1. Oct 2022 – OptOut until Jan2023

Meh, basic auth is a secure mechanism. There are some threats, but they are comparatively low compared to your account being managed by big tech. Didn't take long before I got my first Microsoft account banned because I just didn't want to share my phone number.

I think this is a move to get more people on the MS identity platform. I use that too for corporate stuff. There are advantages here with a corporate infrastructure. But I really think oauth2 will introduce many security issues simply because users (devs) don't know how to handle tokens and because identity providers don't deserve much trust.

No API access for you if you do not register your App at Microsoft. That means you have another key or certificate to babysit.