The point is obvious: it would give anyone who intercepts the (plain text) email full access. However, the price for not doing this is pretty high in terms of

The point is obvious: it would give anyone who intercepts the (plain text) email full access. However, the price for not doing this is pretty high in terms of conversion, so as far as I'm concerned it's not a black and white issue. If there's nothing particularly sensitive to be compromised (and that usually isn't the case at this stage), simple measures like rapidly expiring the verification URL and allowing it to be used only once is "good enough" for most sites. There are no absolutes in security.