I mean... that's up to Google how they choose to implement app passwords. Back when they still supported them, I think they were properly scoped.

An app password is basically just an API token, it's up to the backend what powers it grants.