I'm guessing they were going off the doctrine of "You have no expectation of privacy in the external packaging of your mail" <insert lawyeresque point about "lol tons of people handle and see it">.

Thus, they didn't see a need for tight security regarding who can get access to such images.