2. Use a Google oauth2 compliant client to obtain an oath2 access token
which you then use as your password in your libre IMAP/SMTP client.
However, at this time, there doesn't seem to be any libre Google oauth2
client we can use. If there was, it would be theoretically possible to
access your emails and send new ones using only libre software and avoid
needing to login to the non-free settings page to setup application
passwords.
There exist libre mail client software packages that use oauth2 to talk to Google/Gmail. For example, nmh, which can be used inside emacs with mh-e. That said, these packages have practical downsides to pure libre usage, including both Thunderbird-style "we think we know what you mean" reading of the terms and conditions as well as user-setup instructions that include running probably non-libre Google _javascript_.
In the end, it would be great if the FSF (or someone else) could get Google to go "on the record" about the details of the Terms & Conditions, but that's been the state for several years now, and it doesn't seem likely. (In fact, it's a common refrain among frequent gmail users running Chrome, Android, and iOS apps that gmail is basically unresponsive except to periodically push out undesired changes.) Still, it would be great, hope springs eternal, etc.
In terms of practical advice for people who want to use emacs and are stuck at least part-time on gmail (or "Google Workspace", or whatever it's called this month), the various middleman approaches ala mbsync or davmail are functional. The main complication there is in trying to automate things that Google (MS Office 365, etc) design as (frequently changing) interactive web pages, and the results are often fragile or confusing. I'm a firm proponent of Hanlon's Razor, but it's hard to believe that this outcome isn't at least tacitly accepted.
Hope that helps,
~Chad