Google only lets you use app-specific passwords if you have set up two-step verification (and provided a phone number).
If you have an email client that doesn't speak OAuth and you can't/won't set up 2FA then this proxy of mine lets you use any IMAP (or POP/SMTP) client with an OAuth email provider, regardless of whether it supports OAuth 2.0 natively: https://github.com/simonrob/email-oauth2-proxy. No need for your client to know about OAuth at all.
If you have an email client that doesn't speak OAuth and you can't/won't set up 2FA then this proxy of mine lets you use any IMAP (or POP/SMTP) client with an OAuth email provider, regardless of whether it supports OAuth 2.0 natively: https://github.com/simonrob/email-oauth2-proxy. No need for your client to know about OAuth at all.