email is not the same as the web. HTTPS seem a bit more permissible than smtp/imap. That said I know that some banking sites do reject old version of browsers on the basis of security.
Some providers (email and others) can also continue to support deprecated/broken security for a very long time in order to not having to deal with customers using old deprecated software. 512 bits RSA public keys for example was used a very long time, long past where different standards and recommendation had a much higher minimum. Algorithm and key attacks are quite rare so companies can keep a low security standard for many years/decades before anyone exploits it. For customers that could be seen as a positive or a negative depending on perspective.
Some providers (email and others) can also continue to support deprecated/broken security for a very long time in order to not having to deal with customers using old deprecated software. 512 bits RSA public keys for example was used a very long time, long past where different standards and recommendation had a much higher minimum. Algorithm and key attacks are quite rare so companies can keep a low security standard for many years/decades before anyone exploits it. For customers that could be seen as a positive or a negative depending on perspective.