Without other tools (e.g. PGP) email is not a secure communication medium. Any email can be intercepted from any server or router it passes through between sender and recipient. This weakness has nothing to do with compromising the password of the recipients' accounts, it's a fundamental flaw in the design of email.
That's no longer true. Most end user access to email is over a secure channel (https/imap with tls). While SMTP between most servers uses TLS as well.
The problem is we don't know if the message was sent over secure channels or not. I suppose the password less scheme could refuse to work with SMTP servers that don't encrypt the traffic.
This does in no way prevent those servers from reading and/or altering your message.
Hint: if your provider checks your email for viruses, it must be able to decrypt them.
