Magic links inherently have that flaw - think password reset emails, they’re no different - it’s not specific to Monzo, as much as your argument tries to suggest it is… If your email is compromised you’ve got huge issues.
Besides, your account is read only without your pin.