This isn't about letting people know. People are using legacy apps that might not be getting many updates. I paid for a product that had this and then someone just decided to take it. I didn't actually find out about it because my IT department was you know gutted by Covid and I don't read MS press releases. If you don't want it for your account go for it, but don't force it on me because you think oauth is so great. I don't really think oauth 2.0 is a huge improvement and setting it up is cumbersome to say the least. I'd rather seen IP whitelisting and other real security vs trying to fix everything with ever more complicated keys. So you have the key and you are in Russia you can still get in? What the heck are we all smoking.
We are going to workaround this with a proxy etc, but honestly I just wish there where real alternatives to Exchange in that corporate America would consider, because this is what monoplistic behavior looks like.