It appears you can block app access by going to the "Apps with account access" page under 'Sign-in & Security' on your Google account page. I just checked on one of my accounts and there are a few apps like WordPress with basic profile access.
This page is hard to find and it's even harder to parse the meaning of the current settings, let alone track changes to them over time.
It shouldn't be that hard to find. Google seems to occasionally send out a link to the security checkup tool that has a summary of all the authorized apps / logged in devices [0]. Judging from the other items I'm seeing there, authorizing any apps for reading email would likely be highlighted in red.
This page is hard to find and it's even harder to parse the meaning of the current settings, let alone track changes to them over time.