A password and a token are different trust models
Basic authentication gives the client a reusable account secret. OAuth sends the user through Microsoft authorization and gives an application scoped token material that can expire and be revoked. Multi-factor authentication remains at the Microsoft sign-in boundary.
SMTP can use OAuth
The SMTP protocol itself does not require password authentication. Modern clients can authenticate to Exchange Online with OAuth, but implementing the browser authorization flow and token lifecycle is beyond many printers, appliances, and fixed legacy interfaces.
Where a bridge fits
A bridge keeps a classic client-facing SMTP credential while handling Microsoft OAuth separately. This is a compatibility choice. New software should generally use native OAuth for SMTP or Microsoft Graph directly.