I dont get why they don't use a more secure form of email (say, a GPG implementation from end to end)?

Unless the problem is its not practical - which i think is only a matter of familiarity.