This is the way projects used to be, and surprisingly excellent ones still are.
The amount of knowledge built into this is incredible:
https://imapsync.lamiral.info/S/news.shtml
// imapsync did 14M to 21M mailboxes transfers per month in 2024, or 0.22% of ALL email traffic
"Credentials encrypted in memory only and deleted immediately after migration".
I have no way to audit/verify this claim. You're essentially asking users to hand over the keys to their entire email history on faith.
Turns out Proton is super picky about RFC compliance and will reject anything that doesn't met the criteria, which sucks because GMail does exactly the opposite and will take almost anything you throw at it.
So I have so far written about 7 different regexes to fix some specific mailer issues to make them RFC compliant, with plenty more to go. And even then it still somewhat sucks because I am, effectively, modifying the emails to a state they were not received/sent in.
I also can't imagine there is much demand for IMAP only email migration services these days.
It supports large mailboxes, preserves full data integrity, requires no setup, and works with any IMAP-compatible email service.