That’s indeed a good point, and very much possible!

From: dovecot <dovecot-bounces@dovecot.org> on behalf of Gedalya <gedalya@gedalya.net>
Date: Wednesday, 1 June 2022 at 14:04
To: dovecot@dovecot.org <dovecot@dovecot.org>
Subject: Re: Restrict IMAP login, but allow Postfix SASL

On 6/1/22 19:57, Lucas Rolff wrote:
> this assumes you don’t have any webmail running on the same host, since that would still allow authentication.

One could configure the webmail to connect to IMAP over some local address that isn't in 127.0.0.0/8, one that's on one of the network interfaces, or one can even add a special IP address for this purpose to the loopback interface