You probably are well-aware that the providers can access the emails.
The 2 providers may or may not transfer emails between them over an encrypted channel. Some providers have agreements with others to only exchange emails between them over an encrypted channel.
About 50% to 60% of the emails Google exchanged with different providers in 2014 were encrypted, the other 40% to 50% weren't. (Source.)
An unencrypted email transported in plain text between email providers can be read by anyone who sits between their servers. Especially by secret services which have access to internet exchange points.
But against secret services, securing anything via HTTPS is flawed anyways. They can easily create certificates you trust and can easily read or manipulate your HTTPS traffic. Even antivirus companies can compromise HTTPS traffic and in fact do this all the time which I got a lot of downvotes for claiming it here until providing proof. So really, your 6th assumption is wrong. And this means your 3rd assumption is worthless.
We can kick out the 5th assumption, too, because either party is probably using a Windows or Mac OSX computer which have universal backdoors and are already compromised before they are shipped to you. If either party has an antivirus software installed ... well, I think I already discussed who can read then, too, in the previous paragraph.
Countries which don't feel like their secret services are powerful enough – like Germany – simply create a law which states that (in the case of Germany) email providers with at least 1 k email accounts and companies which don't provide email to others but only to themselves with at least 10 k email accounts have to buy hardware which delivers inbound as well as outbound email traffic to authorities. In the case of Germany, these emails are automatically checked and each year dozens of millions of emails are found suspicious and are directed to a human to read.
