On the other hand, when I receive a valid credit/debit card, it's a plain envelope and the sender name is not there. There is a return address, but no name. But when I receive a pre-selected offer to apply offer with a fake card, always a name.
It shouldn't matter. Last 10 years or so, my cards had to be activated online first, before becoming useful.
Requires someone able to intercept the post (eg corrupt postal employee or subcontractor), and the ability to create a convincing replacement envelope/letter, but it is all achievable, and I expect not everyone will properly scrutinise the envelope/letter/card for signs of tampering. Even for me, with a new card only once every 3 years or so, how can I tell the difference between their letter being tampered with and them just using a new/slightly different design?
It may also be possible to pick the card up at the bank (instead of post delivery). I did that once before, too.