In itself it's probably not that catastrophic because the likelihood of that mail actually falling in the wrong hands may still be small enough to fit inside the risk model of credit cards which regularly puts convenience over security. Though it's easy to do it better without trading much convenience so I agree this is a sign that they probably don't do much better where it absolutely matters, stay away.