I guess Microsoft upgraded Outlook to now supposedly do the OAUTH thing, meaning it should work with the 'regular' ATT.NET passwords (the same ones we would use to log in to the webmail). That was the former 'workaround' for Outlook not having OAUTH2 (whatever that is).
For a long time (maybe a year or so), Outlook was successfully handling all my att.net email accounts with the Secure Mail Key entered as the password for each of my accounts. What you say sounds plausible, as *something* has changed over the past 3-4 weeks.