The issue was Sparrow would have to handle notifications themselves, which would mean every user's Gmail account (user, plaintext password, and mails) streaming through their servers that likely aren't hardened against attackers nearly as well as Google's. Understandably, this is a risk they didn't want to take.