"Should not be" and "is not, ever" are, unfortunately, two wildly different world states.

The fact is that email is often the keys to the kingdom, if compromised, or the baited hook to be used in phishing. With consequences which have had globally-significant consequences, to date.