Well it turns out that you are quite right. There has been a new release of Mail::Sendmail which adds "auth" as a field and is the first stable release in some 15 years (v0.80 has the auth field, v0.79 doesn't). That will teach me to assume it was abandoned.

The comment in the docs now says "Experimental SMTP AUTH support (LOGIN PLAIN CRAM-MD5 DIGEST-MD5)", so that's the progress. Thanks for the heads-up.