So you could go somewhere and effectively say "issue me a username and password that's just for my email client, which doesn't provide access to any other Google services".
EDIT: Looks like they do offer exactly that feature, they call it "app passwords": https://myaccount.google.com/apppasswords
Though it's weirdly open - that page says:
> Just like your normal password, this app password grants complete access to your Google Account. You won't need to remember it, so don't write it down or share it with anyone."
I don't want complete access, I just want access to email via IMAP!