Also, EMAIL_TRANSPORT_DEFAULT_CLIENT may be needed to announce your are coming from a domain or ip that you have whitelisted on your mail server. Sometimes with gateways localhost is blocked.
Additional: I have confirmed that CakePHP runs _auth() which starts with _authPlain() and then _authLogin(). You can find it in the /usr/share/php/passbolt/vendor/cakephp/cakephp/src/Mailer/Transport/SmtpTransport.php file for reference.
We don’t recommend altering the source code because it will get overwritten. However, if you want to modify it to start with _authLogin and see if that solves the problem, it would be helpful to know.