Offering an IMAP service runs the same security risk under Exchange as it does under G Suite, namely, it’s a username and password login flow. It’s also disabled in Office 365 if you opt for a secure configuration.

The one difference might be, if you have a Windows domain, you could integrate MFA into your domain login process and then use AD’s built in Kerberos to authenticate mail clients to the IMAP server. That’s still relatively Microsoft-proprietary stuff. Thunderbird on Linux probably won’t access that, even though “Kerberos” and “IMAP” are nominally things it supports.

I think what changed here was a less a shift towards proprietary architecture and more an increased emphasis on MFA.