If IMAP is broken from a security/privacy standpoint, why not propose a new standard? This sort of behavior to vendor lock in should be dissuaded by antitrust laws. There was antitrust during Netscape times and a lot of good has come off of that. If you think about the "cloud" based monopolies now, they can stifle innovation in similar ways but there hasn't been any focus on cloud based antitrust behavior.

[1] Googles response to an IMAP application approval below - if you don't use every single feature of IMAP then the user data policy bars your application from using it.

""" We can allow the usage of IMAP only in situations where the app ALSO complies with our User Data Policy. To further answer your question - yes the https://mail.google.com/ scope is required to use IMAP BUT to gain access to that scope you must comply with our User Data Policy.

Under our Google API Services: User Data Policy "we require that developers do not request access to information that they don't need and should only request access to the minimal, technically feasible scope of access that is necessary to implement existing features or services in your application, and limit access to the minimum amount of data needed." The usage of IMAP for your app alone does not justify the need for https://mail.google.com/ as the functionality of the app can be achieved using more granular scopes. """