Email is pretty reasonable for secure authentication. All but the most anachronistic mail servers use TLS these days and you're under no obligation to use any of the few that don't. The notion that email is insecure is from the old days when the links weren't encrypted.
SMS, on the other hand, is an abomination to this very day and should not be used by anyone for anything.
