[bigfatkitten]

Client side support for strong authentication is pretty much nonexistent outside of the oligopoly.

Mail clients support SASL XOAUTH2 using hard-coded client IDs/secrets only for a handful of service providers; there is typically no user-facing way to add others, even via enterprise policy.

RFC7591 and RFC7628 mostly solve this and have been around for a decade or so, but have been universally ignored by mail client developers because Microsoft and Google haven't implemented it.