That's perfectly feasible. It is not feasible to do the same kind of captures as NSA was doing pre-Snowden, when most of that traffic wasn't encrypted.

> In other comments I've decried companies like slack including your password reset or login codes in the email subject for example

That's still just as encrypted as the email body itself.