Thanks @JammyDodger for pointing me towards this topic.
I have the same problem that @Amicable reported here.
Can I just check the process?
I enabled 2FA on my gmail account. This then revealed/added the option for me to create App Passwords at https://myaccount.google.com/security
I then created a new app, and copied the 16 digit password.
I checked my inbox and saw the security emails you mentioned, I followed them through and confirmed “it was me”.
Then I went to my Discourse settings and changed the pop3 polling password setting, removing the old password and replacing it with the 16 digit app-password.
Is there anything else I need to do? I’m now seeing this is my logs:
Job exception: -ERR [AUTH] Application-specific password required: https://support.google.com/accounts/answer/185833
Have I missed something? 
Do I need to restart anything?