There are many types of email notifications and for some read access is different than setup access.

Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications.

In general unsubscribing should not be unduly harder than it needs to be.

For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.