There's one thing I don't understand. As you mentioned, the main worry with having email compromised just once is that the person can see everything you've ever sent/received. The purpose of the application passwords is that they allow applications to access your Gmail with a revokable password in case those applications are compromised. However, correct me if I'm wrong, but if one of those passwords is compromised, it bypasses the 2-factor validation, right? So if one is compromised, the hacker has already accessed all your email, right? Doesn't that defeat the purpose of revoking since they're already in your email?