Speaking as someone who has (and still is) an engineer that designs and builds data and Internet transit networks…I can tell you that interception of data of email and web traffic across the wire is rare. Not completely unheard of, but very rare. It’s too hard for the vast majority of malicious parties to do this, especially remotely because it often involved elements of physical access to the wire. There are far easier ways to get your hands on data than sniffing data in transit. The volumes of data flowing around are so phenomically enormous that even to capture and save all of five seconds of data across a major carrier link and reassemble it into meaningful useful data would be nearly impossible. We’re talking tens of thousands of simultaneous streams of data all at varying rates and it’s unknown what they are or who they are to or from. Too hard to be practical and more importantly it requires some pretty expensive equipment, physical access and people with very good skills to get anything useful out of it. Most hackers prefer cheap, remote access and have varying degrees of skillz 
And if you assume that transit via email is not safe, then you would have to consider if the main alternative which is sending a paper copy through the post, is any more or less secure. I’d say it is significantly less secure than via email! Get my hands on something in transit or that is mis-delivered to my address and I have the originals in my hand! Oh…or a Fax? Yep, accidentally sent to the wrong number and you’d have no idea that it had even happened, and for most places your fax would be either scanned in to email or printed off on physical paper at the recipients premises anyway.
It is MUCH MUCH easier to break into the sending or receiving machines to get that sort of information because it is (often) already in plaintext and already assembled in a way it can be used unlawfully.
See… it all comes down to trust of the party you are sending the data to not the transit to get there.
What is, has, and will continue to be the #1 threat is what happens to that data and your documents after they are received. You have no control over that, nor visibility of it. You have to 100% trust that the other party maintains physical and logical security over the information they have. In this case you have to trust that Afterpay are careful with the handling of those documents. It doesn’t matter if they are posted, emailed, or in a computer system the care factor and the concern here is the same. There is no difference between a bank statement that is posted or a bank statement PDF printed off.
A pile of client paperwork like bank statements and personal details left on a staff member desk in an office where visitors walk past is a real risk that you’d never even know was happening.
Which is where Medibank and Optus amongst others are in hot water right now. Not because data was intercepted over the wire or in an email or in transit, but data that they had saved/stored on a server was broken into and a copy taken of it.
So you’re absolutely on the money in terms of asking about it, and Afterpay as well as any organisation that deals with Personally Identifiable Information should have a very clear and well defined policy backed up with suitable physical and electronic controls over who has access to that information. I’ve highlighted physical because that is still a major security threat that many people overlook.
