Say I want to "send as" gmail account 1 from gmail account 2.
It seems that once I activate 2FA for account 1, I now need to use an "app password" to use it in account 2.
But doesn't this defeat the purpose of 2FA on account 1? Because now there's an app password which can be used from anywhere by any client without 2FA.
Am I missing something?