Everyone seems more interested in nitpicking the specifics of what OP is saying

Yep. That's how security works. You have to nitpick the specifics.

The reality is nobody has invented a perfectly secure authentication system that is easy to use (for example, allows easy recovery when people forget their password which for any large service will be tens of millions of times per day).

Attempts have been made - passkeys being the latest one - but they're not even remotely easy to use as soon as you step slightly out of the most common path (such as using the web browser that is provided by the company you're logged in with... try to use Chrome with an Apple passkey, or Safari with a Google passkey, and you're going to stumble into usability issues).

Passwords are not considered secure wether they're sent in a plaintext email or not. They can be secure, if used properly, but 99% of users don't follow best practices. As a result almost every web service in the world is insecure and it's the nitpicky details that matter.

Sending a secret to an email address is a standard step during registration for almost any service.