I hadn't ever thought about this but you're right. Best practice for sensitive services like banks should be to have no links at all in emails. I don't think that's likely to change though.