The SMTP protocol is intended to exchange data in clear text over possibly a number of relays. In addition to the common data interception attacks, each and every relay could examine the message (and if found important keep a copy of it). Furthermore, many end users do not own their own mail server, so the message is kept (still in clear text) on their mail provider server.
And all those attacks cannot be detected, either by the sender of by the receiver.
In contrast when only a link is sent, the message is only kept on the sender server, and is (normally) downloaded through HTTPS and because of that cannot be easily intercepted.
That being said, as the link is sent in a simple mail, the link itself can be intercepted and an attacker could use it to steal the sensitive data. But at least if the real user also uses the link, the sender could detect 2 different connections and be aware of the attack.
The correct way would be to securely identify the recipient before a message is sent there. This is commonly used by banks: they send a rather innocent message with that simple information: a message is available. Then the user has to use its account (along with a secure connection way) to download the message.
BTW, the really secure way would be to use X509 certificates. That way S/MIME allows to send a signed and encrypted message that only the real recipients will be able to decrypt. But unfortunately, X509 certificates are seldom used outside closed organizations...