That says less about crypto and more about default permissions for new accounts. E.g. if your CI let you open connections to tcp/25, got abused by spammers, and then added extra registration steps, would you blame existence of email?