I asked the wrong question based on a mistaken assumption. That assumption was that Apple was somehow escalating privileged access. instead my problem was provider - 3rd party client problems, for example Microsoft kept disbanding app passwords by some unknown metrics. Google just labeled some of them unreliable, see:Geary.
I had mistakenly assumed 2fa to mean login pass and authentication always. That just isn’t so - in fact I knew about ”trusted devices”, the confusion came from this tiny detail; my iphone wan’t listed as such a device, it could presumably be removed by ”revoke all” but I need mine operational 24/7 and daren’t risk it now. Based on comments, my hypothesis is that, if certain clients aren’t even trusted to handle the very basics, perhaps apple mail - on ios - on an iphone, was given a special token, a token with no set final date, always on, unless revoked. Oh and I did check that authenticator weren’t even required, on this phone. The answer according to my options is C, this is a trusted device. As for the token, I don’t know exactly. Input from apple server modified by some unique process to send the resulting output as proof of identity? But now I’ll know what I’m looking for, it is not authenticator nor a manual prompt. I suggested that the prompt was only needed once, but something similar might just be running under the hood.
I mistakenly identified iphone as single point of failure, to be equal to untrustworthy. And yes, it could establish a vulnerability in some cases, but I made a gross exaggerarion. So let’s compare it to a pc computer: 1) encryption as default vs optional, 2) optional login pass 3) biometrics. The phone has similar or better options and phones often have other architecture security benefits. Both devices use authenticators and password managers too. I can’t recall giving my iphone a special status, but I must have done so. After all it was a matter of 1) device pass login 2) google pass login 3) terms and confirmation 4) google prompt to confirm.
Two passwords and a 2nd factors, pretty good identification to me
Potential issue: ease-of-use can be misread as lax sexurity, disfunctional logins can be misread as strong security. Or wait was that just me? Can’t be just me
Summa summarum: my concept of 2fa was very rigid, I even misattributed flawed auth scenes to stricter security,
p.s I posted a horrible blog entry here that was illegible and incoherent. I’m struggling with record heat. Having regained some composure I’ll stop here and thank you for pointing the righr way.