There's absolutely nothing insecure or wrong with app passwords for a local client application.

The whole point of OAuth2 is to allow logging in to some untrusted 3rd party site via an authentication provider without having to key your password into the 3rd party site.

a) Local client software like Thunderbird is/must be trusted, it's not a random 3rd party website.

b) App passwords remove the risk of Thunderbird stealing your password, even if for some reason you didn't like typing a password into Thunderbird.

c) Google is both the Authentication Provider and the Resource Server in this example, so it adds zero security.