I ended up building a hosted POP/IMAP bridge that does what Gmail used to do: logs into your external accounts on a schedule, fetches new messages, and forwards them to Gmail via SMTP with proper SPF/DKIM alignment. The key difference from auto-forwarding is pull vs. push. Spam stays on the external server instead of getting forwarded into Gmail.
It's at https://mailbridge.app. Currently collecting waitlist signups, polishing the MVP now. Happy to answer questions about the technical approach (credential encryption, deduplication, deliverability, etc).
Some previous discussion with mentions of that:
Gmail will no longer support checking emails from third-party accounts via POP
Best part for me is that it only needs write access to Gmail, so I'm not handing it the keys to my Google data.