Why are my plastic credit card and activation code sent separately?
Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once.
This prevents a mail thief from simply walking up to homes and looking for credit cards and activating them all in one step. Now suddenly the thief has to go back to the same house, or intercept the same person's mail at least twice, and possibly multiple days in a row. That takes time, effort, and additional exposure.
A lot of people get a credit card and leave it in the envelope for a considerable amount of time.
Further, separating the data complicates life very greatly for a mail thief. To snatch one piece of mail is a crime of opportunity. But to snatch two on separate days requires veritable stalking. Having gotten one piece, the thief must now return to the scene of the crime often. That greatly increases exposure, both because of the lingering and the repeated visits.
Further, it's likely the correspondence is not obviously marked with a sender, so the thief does not know which piece of mail to steal, and must steal a lot of it. This greatly increases the chance of the owner noticing their mail is going missing, which would defeat the entire exercise as the owner would cancel the card.
And after all that, there's a fair chance that the piece the thief lifted was the second to arrive... In which case the other half of the puzzle will never show up. The thief could check for weeks and never get it. When to give up?
Credit cards are stochastically secure (like all banking).
They aren't trying to make the system unbreakable, they are trying to make the fraud losses be a suitably low percentage of the margin.
(And optimise for cost and convenience - if you had to visit a branch and show three forms of ID, as well as their needing many expensive branch clerks, a lot of customers would never activate their card and hence never generate any revenue).