The vast majority of email is clear text and is quite easy to intercept between in transit if any of the transiting email servers do not use encrypted links.
My current main bank is mobile app only so security is authentication is FaceID. My other bank uses an ID code and a grid of numbers that changes every time I visit the website for me to punch in my passcode. Not sure hire’s that works. No 2FA though.