Google still offers a workaround for applications that don't use OAuth2, but they don't publicize it. You need to create an "app password", and use that to sign in instead of your normal password.
First, go to https://myaccount.google.com/security and turn on "2-Step Verification". Follow the instructions to add a verification method for your Google Account. Unfortunately, there is no way to avoid this.
Afterwards, go back to https://myaccount.google.com/security and select the newly-available "app passwords" option. Use the options provided to generate a new app password.
Finally, remove your Google Account from System Preferences, then add it back again using your newly-generated app password in place of your normal password. (I recommend completely removing and re-adding the account like this to avoid potential problems with sending messages in Apple Mail.)
Afterwards, you will once again be able to use Mail, Contacts, Notes, Reminders, and Calendar/iCal with your Google Account.
If you are using a corporate Google account, you may need to add your account to System Preferences as follows in order for it to work:
For Email:
Select "Add Other Account..." (instead of selecting "Google")
Select "Add a Mail account"
Enter your full email address and app password in the associated text boxes.
When asked which services to enable, deselect everything except for email.
For Calendar:
Select "Add Other Account..." (instead of selecting "Google")
Select "Add a CalDAV account"
Set "Account Type" to "Manual"
Enter:
User Name: [your full email address]
Password: [your app password]
Server Address: apidata.googleusercontent.com
I have no clue why this is necessary.
If Google ever removes the app password feature (I don't think they will, lest they cut off every plain IMAP email client), consider trying
Yo'av Moshe's OAuth Hopper instead, which should also work.
