It's not a message that needs to be delivered securely. It is literally just "you need to fill in your tax return by the same date everyone else in Britain needs to fill in their tax return". That could have been included in the email body with no security implications.

It's basically crying wolf. Next time they have something really important to tell me, I suspect I'll just go "nah, it wasn't important last time, I can't be arsed to spend three minutes logging in" and delete it.

Nowadays every login requires a 2fa with a sms so got to have that phone handy to login. And as a bonus juggle multiple ids if you have a business account too in addition to your personal returns. Pure crap.