So like every login form in the world, which sends the username and password in plain text over SSL. This is pure FUD.
That it's happening as plain text (notwithstanding TLS on the transfer) distinguishes this from some kind of credentials-sync system (think: LastPass or Keychain) which wouldn't necessarily need to have the credentials in plaintext to function.
But you just gave Microsoft your credentials! How could you not intend that?
They're pretty clear about this: if you set up a 3rd party IMAP account, then yeah, credentials get used. If you set up an OAUTH2-capable account, then it uses that instead. That's why it's a lie, because of course if c't has some custom bespoke IMAP server, it's going to need credentials, and the user is going to intentionally hand them over so it can retrieve the mail.
Not sure what your evidence is for lying. Because they're not.
When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook.
Old outlook didn’t do that. Thunderbird doesn’t do that. This is completely unnecessary for a mail app. My computer can check my email. No reason for Microsoft servers to do it on my behalf.