The scope difference is the whole point
MailApp requests only https://www.googleapis.com/auth/script.send_mail. That is a narrow scope: the script can send email and nothing else. When you deploy a script or share it with a team, users see a consent screen that says 'Send email on your behalf.' That is a much easier yes to click than what GmailApp demands.
GmailApp requests https://mail.google.com/, which is full mailbox access. Read, write, delete, search, label — the whole account is exposed. That scope is appropriate when your script genuinely needs to search threads, create drafts, or read message bodies. It is overkill when you only want to fire off a notification email.
The first time I hit this distinction was on a shared Sheets tool where colleagues balked at the consent screen. Swapping MailApp.sendEmail for GmailApp.sendEmail — same arguments, same result — dropped the consent screen from 'full Gmail access' to 'send email only.' Adoption went from three testers to the whole team in one afternoon.