Derrick, as with the original question above (in February), there are two aspects to things: whether you can use app passwords, then whether you can use oauth for cfmail instead. Let’s take them one at a time.
1 - FWIW I was just able to create an app pwd (at https://myaccount.google.com/app passwords). There was nothing there saying the ability was being removed.
Same at the doc page about it, Sign in with app passwords - Google Account Help
And to be clear, I do use one and that page above shows it having been accessed in the past hour. (To be clear, you do have to enable MFA on the Google account to be able to enable app passwords.)
1a - FWIW, this discussion has been going on for years, with someone finding something that says they are or have been disabled…and yet they keep on working. Surely Google WANTS people to use oauth when possible, and the many (many) different client apps and platforms that rely on app passwords should indeed be updating to support oauth. And just as surely, some will not bother…and at some point those will be left out in the cold.
It doesn’t seem that day has come yet, but the end of the road is coming around some corner.
2 - As for using oauth and Gmail, there have been other discussions here offering solutions for Lucee.
For now, Lucee doesn’t offer cfoauth like acf does (and in recent years supports oauth2). So some discussions refer to using libraries to offer that, like Matt Gifford’s:
As for the general concepts of using oauth with cfmail, some resources may reference using MS rather than Google, but the general concepts can be helpful, such as Check email on O365 with OAuth
And even though showing using cfoauth with ACF, there’s code and concepts here:
https://helpx.adobe.com/coldfusion/kb/authenticate-imap-pop-smtp-connection-oauth.html#smtp
As well as Ray’s 2024 article:
Or maybe someone will offer something more specific for your and Richard’s original request.