I'm not sure I understand how half the attack surface on email is avoided simply by not using email, given the attack surface is metadata and the other informat

I'm not sure I understand how half the attack surface on email is avoided simply by not using email, given the attack surface is metadata and the other information held at rest on the persons own computer, alongside the indexing and command history both of which are noted as significant risk irrespective of transport security. Seems like much or even all of the problem is information sharing irrespective of how its done. Two can keep a secret if one is dead.