I agree with the security concerns. I don’t usually work with such incredibly sensitive things that I can’t email them.
The Things team seems pretty interested in security, but any time you toss something to email, who knows.
I have actually disabled the Email to Things integration on one repo that does include sensitive information (primary possible trade secrets) that I need to lock down.
But that is “day job” stuff anyway, so no major issue.