Application-specific passwords are the only workaround currently provided for applications which don't support two-factor authentication to Google. This does effectively bypass two-factor authentication, but only to a certain degree.
Obviously, the primary risk is that a compromised application-specific password can be used to access your account without requiring a second factor for authentication. Google provides a certain amount of mitigation to this risk by making the passwords much stronger than the typical user-generated password, and also by only displaying a given app-specific password once.
You should also be mitigating this by ensuring security of the environment where the app-specific password is displayed and stored, only using a given app-specific password once, and never copying an app-specific password to any location except in the password field for the application that needs it. Also, as always, don't use the application on networks that you don't trust.
You should also take advantage of the mechanisms Google provides for managing and monitoring app-specific passwords. Particularly:
- Google alerts you to whenever a new app-specific password is created. Pay attention to these.
- You can create custom names for app-specific passwords. Give them names that make sense to you.
- Under "Select app" or "Select device" choose "Other (Custom Name)".
- You can see when the last time was that an app-specific password was used. For applications that are constantly checking in, this may not be very useful information. However, if you happen to know a device has been offline for awhile and you see recent use, this can still be an indicator of trouble.
- You can, and should, revoke app-specific passwords that are no longer in use or which show signs of abuse.
In the end, creation of an app-specific password effectively requires that you accept the risk of allowing that application to have permissions to your account without a second authentication factor.