That’s the reason we have to still use fax machines right?
I know there are ways to do encryption like PGP on your message directly or I think email sent over TLS? But that isn’t the default right and that’s why I can’t send a picture of my license to the insurance company directly over email?
Your email likely is already delivered over a TLS or SMARTLS protected channel. That’s not the (only) problem PGP addresses. PGP provides message authentication in addition to encryption.
To take your colleague as an example, his email was cryptographically signed by him. A function that requires his private key, and possibly a passphrase to unlock the key. The signature includes a hash of the message, and requires that private key to generate. On your end, your client hashes the message again and compares the signature. If it isn’t identical, someone has tampered with the content. Presuming you met up ahead of time in person or through another trusted channel, and shared public keys, seeing the valid signature also gives you confidence that this email was actually written by the person you expect, and not anyone else with access to their device or account. (If the senders key is still safe anyway.)