I went to the settings page, selected "enable IMAP" and used the values in the provided link to set up my Gmail as an IMAP account in Thunderbird. No messing around with account security, no "obscure values" to change.
I didn't even have to generate an app-specific password (I use 2FA), because Thunderbird understands the authentication page request.
> I had "burn after reading" documents that I could never open because of this.
Why were those documents ever on an Internet-connected device?
> I just wanted emails when I open my first gmail account. Not that.
Honestly, if you didn't know back then that Google was primarily an advertising company, and that they would scan your emails to generate targeted ads, you obviously weren't following along, which seems weird considering your obvious focus on security on privacy.
I'm getting ready to migrate away from Gmail myself (I'll keep it running unused as my Google account), mostly so I can have my own domain under my own control.