There was e-commerce before cookies.

The same functionality of correlating multiple requests for a single request (building sessions upon packets) was just more difficult to use by encoding the session ID as a parameter in query string for each request. Many frameworks still support this mode.

Cookies pre-date SSL, so how were they securing that e-commerce that existed before cookies?

Nobody cared. I submitted CC numbers over http connections for years in the late 1990's. I emailed them sometimes, too. I also used telnet across the public internet and never got my passwords sniffed or mitm'd (only on hacker meetups where I would lure people into honeypots by doing fake telnet sessions :) )

By using secure networks? PPP is older than SSL and have been in widespread use for longer time.

SSL is largely irrelevant to banking security anyway. Actual security is built upon charge-back system. The underlying security model was designed when everyone trusted written checks.

Does placing an order on a website, then sending a check in the mail still count as e-commerce?