I don't think that's true for my bank or Czech government services. Plenty others do practice "security by email", though.