Thanks for pointing out to use an alternative sending method or account.
Unfortunately, even if it were accepted remotely one can’t really use @localhost as mail domain reliably, because any reply or bounce would break the dovecot maildir (“Issue D” from Issues to fix email breakages caused by upgrades (regression)) (Sorry, not relevant for sending-only, but using the @localhost domain is generally not accepted remotely anyway, though.)
Also unfortunately, using the real account login requires to make the account password available to the app, which isn’t very good for separation and security.
So the separation is still where the app’s resources.system_user really shines.
And it would be great if the new resources system could also be configured locally somehow with mail_user and mail_domain overrides, similar to the old yunohost user update --add-mailalias.