I agree OAuth2 is a real PITA; I've got a few gmail accounts and it has been getting insane. They don't really seem to want to support POP/IMAP and other non-"gmail.com" web clients. However, there are some options:
I'm not sure if it still be possible to leave 2FA off on an account that it decides is low importance (like if it only ever receives mail from public mailing list subscriptions). It seems to be more and more difficult. In the last few years they added logic that (sometimes) disables access if they detect you trying to access it from unexpected IP address ranges you aren't "normally" using (such as when (rarely) travelling). This basically forced me to enable 2FA on all of my gmail accounts.
Last I checked, it was still possible to enable and generate "application passwords" that you can use in any POP or IMAP client, but not for any other kind of access. (Unless you are using business class "G Suite" and your company's admins disabled the application password option.) Most of my accounts are still using application passwords, and I occasionally get emails about "improving" (scare quotes) my security by disabling them, but maybe I'm just grandfathered in? (I could log in with my browser and check what settings options are currently in gmail's settings, but I disable both javascript and cookies from most places by default (especially Google), and I don't feel like going through the hassle of temporarily opening holes in my personal security policy right now (and tracking down passwords and TOTP secrets for "second factors") just to refine this comment.)
Finally, if nothing else works, I try to maintain some instructions on how to use oauth2 to maintain a normal local UNIX email account routed through gmail, as a kind of public service. See https://mmogilvi.users.sourceforge.net/software/oauthbearer.html. This requires carefully setting up a lot of little details, but once it is working it seems to be possible for cron jobs to keep using a renewal token for years without manual intervention. The instructions, scripts, patches, etc could probably all use some updates, cleanup, and streamlining, but I think all the currently-critical tidbits are there. Including a workaround for google's recent decision to disable so called "out-of-band" initial token acquisition a couple of months ago. I use this for a single account, just to make sure I notice and can try to document it the next time google decides to break something.