Email is already insecure. Even if you use GPG, that's client side, and should be as safe/unsafe as it was before this law (unsafe b/c metadata or unknown vuln). So in terms of threat model, it hasn't changed much.

I'm not defending the Oz gov or companies here, but knee-jerk reactions just open you up to more mistakes. For me, the situation is still preferable to Google having my data/metadata.