I agree it does seem rather insecure for such vital personal data, same with Trade Republic, Lightyear, Bunq etc. As well as what you mention they also know your Irish bank ac as well as your new ac. What individuals at the receiving end have sight of these emails? We never meet or speak to any of them.
I emailed Advanzia customer support to ask what is to stop a third party opening a false ac in your own name, lodging from that ac into your Advanzia ac in the same name thus making this new ac into a "reference ac" for withdrawals, and then withdrawing everything to this new ac. As seems their policy with all email queries, no reply. As far as I can see the only line of defence is the password, as the password change is secured on your email address. And can that be changed... ?
Maybe Germans and Luxembourgers are just very trusting.