That's how most of those tools work from what I've seen. Some let you use an MS365 admin account with impersonation rights, but that's even worse than giving up the credentials for all the normal user accounts.

The biggest problem with every migration tool I've ever tried is they all do a very poor job of reconciliation. I've even used a few that incorrectly report success for partial (aka broken) migrations.

The MS365 IMAP migrations are a good example of poor reconciliation, but at least they give you total message counts if you're paying attention. What I'd really like is a tree view of the old mailbox vs the new mailbox with read/unread message counts for every folder.