They won't. They'll find some bullshit "security" justification to force 2FA with 30 minute oauth tokens or something else that will make using IMAP too annoying for most, and which'll be difficult to automate.

That's exactly what they did with imap. I had scripts checking my gmail accounts using imap with password-based authentication, and for a while they allowed that as long as you expressly accepted that it was less secure, but not it's gone completely.