But it isn't a password for Microsoft's services that's being sent. It's your username and password for another service you probably didn't intend Microsoft to have your credentials for. And it's intended.
But you just gave Microsoft your credentials! How could you not intend that?
They're pretty clear about this: if you set up a 3rd party IMAP account, then yeah, credentials get used. If you set up an OAUTH2-capable account, then it uses that instead. That's why it's a lie, because of course if c't has some custom bespoke IMAP server, it's going to need credentials, and the user is going to intentionally hand them over so it can retrieve the mail.
Old outlook didn’t do that. Thunderbird doesn’t do that. This is completely unnecessary for a mail app. My computer can check my email. No reason for Microsoft servers to do it on my behalf.
Not sure what your evidence is for lying. Because they're not.
When creating an IMAP account, c't was able to sniff the traffic between new Outlook and the Microsoft servers. It contained the target server, log-in name and password which were sent to those Servers of Microsoft. Although TLS-protected, the data is sent to Microsoft in plain text within the tunnel. Without informing or inquiring about this, Microsoft grants itself access to the IMAP and SMTP login data of users of the new Outlook.