Google doesn't let other apps sign in with your normal password, so you'll create a one-off app password just for this migration. It takes about a minute.
Your old mail is only ever read — nothing in your Google account is changed or deleted. The app password is used only for this copy, is stored encrypted, and is erased when the migration finishes. You can revoke it at any time on the same Google page.