Yes, POP3 (and IMAP4) only support password based authentication.

We need to, instead, be using constrained and origin-bound credentials, like with FIDO2 keys