Without a secure connection between your mail client and the mail server, your authentication credentials are sent in the clear - just the same as they would be if you logged into a web site using http instead of https.
This is why many mail providers (such as gmail) only allow the client to proceed with authentication if the client is connected to the server through a secure connection.
Edit in response to comment:
As an example, see the transcript below of an SMTP session with smtp.gmail.com, where the client tries to authenticate with smtp.gmail.com over an insecure connection:
$ telnet smtp.gmail.com 25
Connected to smtp.gmail.com.
Escape character is '^]'.
s->c: 220 smtp.gmail.com ESMTP i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp
c->s: ehlo test
s->c: 250-smtp.gmail.com at your service, [2001:4801:7822:103:be76:4eff:fe11:923a]
s->c: 250-SIZE 35882577
s->c: 250 SMTPUTF8
c->s: AUTH LOGIN
s->c: 530 5.7.0 Must issue a STARTTLS command first. i12-20020a926d0c000000b002c3fa6cf756sm4341516ilc.25 - gsmtp
As you can see, the client sent
AUTH LOGIN to signal to the server that it wants to attempt to authenticate, but the server responded with a 530 error, 'Must issue a STARTTLS command first'. smtp.gmail.com only allows the client to proceed with authentication if a) the client connects to the server securely by TLS (on port 465), or b) the client connects initially over an insecure connection on port 25 or 587, then upgrades the insecure connection to a secure connection using the STARTTLS command.