App passwords are not scoped, are they? When I set up an app password for my whole google account it is never asked whether it is for email, docs, youtube, etc... . The oauth token is properly scoped.

I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped.

An app password is basically just an API token, it's up to the backend what powers it grants.