I think it's required nowadays, or at least used by default, but less than a couple years ago HTTPS was a setting you had to manually enable and before that wasn't offered at all. Also HTTPS is only secure if you trust the cert companies, which I don't after the multiple fake certs issued last year (with at least one *.google.com presumably issued to Iran). The best way to secure your sensitive emails has been the same since the 90s: PGP encryption. (The tradeoffs have also been known.)