Seagate had all of its employees W2s phished because someone in HR messed up badly. If you have access to PII or other confidential information, phishing is a big deal.
That’s the problem with HR: the same role deals with lots of outside emails and lots of employee data.
They have to compromise between security and keeping it easy for people to apply.
The more companies that have complicated application portals, the fewer applicants they’ll have. Particularly from occasional job-seekers that already have other jobs.