

For Thunderbird’s rendering engine, Gecko (Rust) is sufficient. It’s sharing the platform from an ecosystem perspective (security measures and maintainability). Initially this will be a pain point but you eventually build up a white-list of legitimate remote content, nice and secure. Thunderbird is based on Firefox ESR, but due to the nature of email clients, the superiority or inferiority of the rendering engine is meaningless.

As email is mostly html automatically loading images from the web is not a great idea security wise. it stops images and other files from being loaded from the internet when viewing an email. Consider going this route if it concerns you. I don’t ever see such emails because I enabled two factor auth and use an app password with a limited scope to the Mail app. Google just want’s the majority of users to go through a more limited access method. Google’s max security disables 3rd party access to your emails, this allows them to: block bad IP’s, use two factor auth and use browser fingerprinting to detect illegitimate access. This is both correct and incorrect depending on your situation. Thunderbird, Outlook ect to be Less secure than the web interface. Google considers all 3rd party access to email i.e. First of all there is nothing to be concerned about
