I first followed alanb's advice and changed authentication method to OAuth2 in both incoming and outgoing (SMTP) servers, after which:
1. (with Mail Shield on) Get New Messages for GMail still reported "Thunderbird: Connection to server pop.gmail.com was reset".
2. (with Mail Shield off) Get New Messages for GMail prompts me to "Enter credentials for [xxxxxxxx]@gmail.com on pop.gmail.com" and "Sign in with you Google Account", at which point it is not at all clear to me which of several linked email addresses is expected. I end up in an infinite loop, where I enter an email address and click a blue "Next" button and am invited to try another "Email or phone", or enter my only phone number in various formats and am told "Couldn't find your Google Account. Try using your email address instead."
I then followed DavidR's advice and exported and imported the Avast Email Certificate, to which Thunderbird responded "Alert: This certificate is already installed as a certificate authority", after which Get New Messages for GMail still reported "Thunderbird: Connection to server pop.gmail.com was reset".
In the middle of all this, Avast, apparently independently, produced prompts to install updates and to reboot.
I will report back after rebooting.