There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getti

There's not really anything you can do about this unless you want Wmail to have to stand up a server to authenticate with, at which point you're no really getting any additional security because Wmail still needs to store some sort of credential on your machine for persistent login that an attacker could steal to authenticate with Wmail on their own machine. An attacker would have to steal your access token stored locally on your machine to use with this public client id and client secret, and if you have software that's maliciously scraping credentials from your machine you already have a problem.