You're not wrong there. SMTP dates back to 1981, and at that time, there were zero security features, and it was designed to be used for plain text only. Every other feature of email has been glommed on to that core. HTTP, DNS, FTP, they all suffer from the same kind of thing - developed a very long time ago when security and identity were barely a thought.

I don't know the details of how standards for ActivityPub is written, but being that it is much newer, I have to think that more thought has been put to modern needs. Of course, the modern landscape is completely different than it was in the early 1980s, so it's yet to be seen how this will all develop. That said, these earlier protocols are examples of how a protocol can take hold and not be finally extinguished.