That's actually a feature. Whistle blowers and leaks like Snowdens are helped by these antiquated setups.

What's wrong with email? I keep seeing "email is not secure means of communication" but doesn't email use TLS?

Not all the time. You don’t control the mta to mta protocol - it could be plain smtp over port 25.

It's the document control aspect rather than the protocol. Preferable in this sort of work that authorised users log into a proper case management system, rather than pass around a document with all the data.