My first thought is that this sounds similar to what Outlook did some years ago with the advent of oAuth identification methods. Running through the protocols in my head, it sounds like Google stopped accepting "plain" SMTP, which doesn't sound right. I think a call to Google's customer service would be in order, because even Outlook allowed a way to get there from older (non-oAuth) versions - by implementing an alternate, very long password - 16-characters worth of password, all lower-case alphabetic.
My next thought is two-fold - first, that to be compliant with "standard" Internet protocols, they need to support some alternative, and second, they should already be getting some pushback from disenfranchised customers.
That thought doesn't help you, but offhand I doubt that CDO can be made to operate as oAuth-compliant. The last major update of CDO was the 2000 version and at the time, it was announced as the last version that would ever be made. I would be happy to learn that some updates to CDO have been made, but forgive me if I don't hold my breath in anticipation.
Here is an article that emphasizes an important factor: The affected accounts are based on the FREE GMail accounts as opposed to paid GMail accounts. So - <sarcasm> purely in the name of increased security </sarcasm> - perhaps Google is forcing folks to upgrade to a paying service.
Google has announced that as of May 30th, 2022, it will disable control over Less Secure Apps on free Gmail accounts. Read to see impacts on organizations.
www.marconet.com
I know it is a pain in the
toches, but perhaps the solution would be to find another free e-mail to use as a medium for sending and just include an explicit reply-to for the CDO message build. Since I have no idea about the magnitude of your exposure here, I have no idea about the amount of work that comment represents. But given that the problem targets free accounts, I'm supposing that the customers in question are too frugal to upgrade? Just thinking out loud here.