Besides being used for authentication?

https://learn.microsoft.com/en-us/exchange/client-developer/...

More like authorization. Authentication is completely opaque for most people using gmail. (except for those very few using service accounts and signing their own authorization tokens)

Or maybe you can enlighten me how you can get the token for XOAUTH2 from just your gmail email address and password without involving any opaque google service.

Authentication is happening completely outside of OAuth inside some google black box. 2FA has nothing to do with OAuth at all. It's just another feature of the google's black box which decides whether to give you the access/refresh tokens or not.

You can use 2FA with static password authentication. Remember the “password” here only means “character string”, it can easily carry an OTP.

Right, just as with XOAUTH2, the "password" sent to the server is actually the (encoded) OAuth token.

So what does it improve then, that would justify the incompatibility and added technological debt (dependencies)?

Well the question I responded to was "What does oauth have to tho with authentication".

I fully agree with the move away from plain passwords in this case, given that it's no longer "just" the password to a mail account, but to much, much more.

Now while I think OAuth adds some features that can be useful in certain settings, I'll be inclined to agree that requiring OAuth isn't the best move.

However the alternatives would probably require a lot of extra work on Microsoft's behalf, like being able to set up device-specific passwords or similar.

So, given the need to move away from plain account passwords, I can understand why they wouldn't want to do that and just use what they already had.