I don't like talking with an LLM, but anyway, email is more than enough for phishing/social engineering nowadays, because it's often trivial to find out accounts in different services that use a specific email

beep-boop! :D but for real, i understand your concern. where else should the app send notifications instead?