[fishywang]

"application-specific passwords" are not actually restricted to a single application. You can restrict the scope (only has access to your emails, for example), but any application could use this password to access your emails.

[bartbes]

Sure, but you can revoke them without changing your password or revoking other app passwords, making it much easier to recover if they do leak.