This could be a bit more secure than what my bank usually does when issuing me with a new banking card, depending on how they handle their end.
I usually get two letters: The first contains the card, the second contains the card's initial PIN code.
Your bank negotiates a password with you which they'll use to encrypt a document they send to you. Of course, this still has issues (like people listening in on your conversation), but this seems reasonably secure if the document in question isn't life-changing. Note that them calling you on the phone means that they've already done a simple authentication of your person - they have your phone number on record, so they call that number and can be reasonably sure that you're the client. They have you provide the password instead of generating one themselves, which can be a good sign because ideally, it means that the password only exists in two minds - yours and the bank employee's who asks for it and immediately encrypts the document with it. (But there's no way to know if that's what's happening on their side). Calling you to negotiate a password is also more secure than sending two letters because they use two channels of communication: The phone and e-mail. In the two-letters scenario, they can't defend against a very simple attack: The mailman (or anyone else with access to them) intercepts both letters. It's harder for a single person to have access both to your phone conversations and your e-mail conversations.
There's one important thing that wasn't verified: Whether the call you received was really from your bank. In order to verify that, you'd have needed to call them using a phone number that was available on their website, for example. Since the call wasn't authenticated, you could find yourself as the target of a scam that tried to build confidence in the authenticity of the follow-up e-mail you'll receive, even though it might be a complete fake...
A professional way for the bank to handle this encrypted communication would be to use asymmetric cryptography. You give them your public key, they encrypt with the public key, you decrypt with the private key. Before they encrypt, they'd need to call you to check the fingerprint of the key, but you wouldn't have to exchange a password, so a passive listener would have no chance to intercept it. You could also verify that the letter really was from your bank because they could sign it with their private key, and you could verify the signature with their public key, which they made available on their website.
Since they must have told you which software to use in order to decrypt the letter, they could just as well have suggested a software package such as PGP or GnuPG which supports asymmetric encryption and asked you to generate asymmetric keys and provide them with the public key.
The reason they didn't do it this way is most likely because public key cryptography is a bit harder to understand than just typing in a previously negotiated password in order to decrypt a file, and since they have lots of clients, some of them might not understand how to handle asymmetric crypto.