That specific GMail account flag simply allows system that uses standard SMTP to connect without using OAUTH2.
The only secure password authentication method gmail allows SMTP clients to use is a (non.standard) XOAUTH2 SASL mechanism (the correct tag is actually OAUTHBEARER).
GMail has decided to refuse all other secure login mechanism: you're either using their own flavor of OAUTH2 SASL or you need to enable that flag and use the LOGIN (i.e. cleartext) password. Security-wise, your password is still proetcted by the TLS encryption. What changes is that the client application needs to keep your password in an encrypted format while, with OAuth, it keeps an access token (a per-application password, if you want).
In other words: it's not that Outlook does not "meet modern security standards", it's that google have a very peculiar view of what these standards are.