Collecting credentials and reading mail from server is standard practice across hosts of email clients, since it’s the only way to get push notification working. If you don’t trust their server you probably shouldn’t use their client anyway.
That seems much more secure than having a third party collecting my passwords so they can connect to my mail server from their network using my password just to see if any new mail is there, read the messages, then send a notification to my phone to let me know about them.
I'm perfectly happy to trust Thunderbird enough to configure it to check my mailbox, but I wouldn't feel as comfortable handing my login information directly to Mozilla so that they can log into my mailbox whenever they feel like it. I guess Mozilla could push an update that collects my stored login credentials and do that anyway, but if they did I think there would be a lot of folks who'd protest.
Desktop mail clients do. Phone mail clients can’t, so you either check on a server, or don’t get notifications on time.
I've never used a mobile client that used a third party to monitor a mailbox, they all do polling as you suggest. I'm not sure the man in the middle approach it's as common as OP is implying here (for non-first party clients).
This reminded me of Pointcast Networks. Ah, the 90s. :) https://en.wikipedia.org/wiki/PointCast https://www.youtube.com/watch?v=qCqwB6sruIQ
I'm sure the third party you share your email just to get push notifications with isn't monitoring your mailbox to the second either...
They can but consider this: How would they know to send them?
If you are adding a provider only locally there's no way for the app to know to generate a notification if it doesn't have an IMAP idle connection open constantly or scheduled polling. If the app is shipped by the email provider (like gmail app for ios using a gmail account) they can send pushes without leaving connection open or polling.
The point of having your details with the app developer is that their servers will remain always connected to your email provierr and generate pushes that will go over Apple or Google's push network.
I guess otherwise I'd rather it be my phone regularly polling my mail server over my connection than a third party regularly polling it using theirs. I can see it being a popular option for folks on expensive/very limited data plans though. It doesn't take a ton of bandwidth to poll a mail server, but checking every 5-10 minutes it could add up.
Does it occur to you that there are so many different variants of Android and they all do their own thing regarding background processes? It is so complicated that you can find websites like this https://dontkillmyapp.com/
And yes I still lament the loss of the blinking red LED, a victim of phone makers today treating devices as if they were a piece of jewelry as opposed to the utilitarian tools they really are.
In some countries this is "unauthorised access to computing systems".
But Google and co. are above the law anyway.