This is for google workspaces (paid google accounts for business). If you're an admin of your domain, you need to enable 2-factor authentication before creating an app password. If this is already enabled (or you already use 2fa for your email) for your organization, then you can skip this step.