@gildedpeep Correct. Even if you use an anonymising proxy (which removes the location leak), you still have:
confirmation of your email address to spammers.
confirmation to the stalker that they still have the right email address.
confirmation to the stalker that the email has been read for a fifth time, and they still have an influence over you.
confirmation to the stalker that you are still probably in their timezone.
confirmation to your boss that you opened it for the third time and you still have not replied.
confirmation to that external company that you are in fact still considering their proposal, even though you are trying to act like you are not.
data going to those trackers that try to build behavioural profiles.
All of those are things that email trackers actually get used for, and email tracker services are used by a surprisingly large percentage of emails. A proxy can perform very limited heuristics ("this is the third IP address to click a link with that token in it, it is probably not a tracking ID"), but only at the expense of messing it up for the first few users to be seen with it. So it is unlikely to be effective as any kind of protection there. A stalker is probably only targeting one person, so they only need a very basic URL that looks harmless, which nobody else will ever open - no tracking tokens are needed, and a proxy will think it is harmless:
https://privately.owned/
Trackers can be very well hidden from a proxy too, using URLs based on IPv6 addresses where the address is the token, using subdomains as tracker IDs, using a few words in the path as the tracker ID, using the hash/fragment as a token (which the proxy cannot see at all since hashes are not passed in the headers, but can be read by scripts). They don't have to be obvious IDs in the query string, which makes it very hard for a proxy to know which part of the URL is safe to remove.
http://[2600:1408:ec00:36::1736:7f24]/
https://three.token.words.example.com/
https://example.com/three/token/words/
https://example.com/?three=1&token=1&words=1
https://example.com/#three.token.words
https://three.example.com/token#words
With just three words based on a limited subset of the English dictionary without taboo words and without words that sound too similar, what3words manages to produce 64 trillion unique addresses. Computers don't confuse similar sounding words, so they could use all slightly different variants of words. Therefore with just 3 English words, a tracker could create 1.25×10^17 unique addresses, which is more than enough to allow any tracking they want (the same as ?trackertoken=aZ7tP9wXq3). And it can look like a harmless URL to a human or a proxy.
Loading external content and clicking links in emails will always come with those possibilities, unless there is some large-scale heuristic based on monitoring of email contents from a large audience, with email contents of everyone being read and used for analysis before you open the email (and even that comes with some of the risks, not least that the service provider themselves is probably doing a vast amount of tracking of their own - you can guess which company I am referring to). Even so, someone could easily manipulate any such proxy or heuristic by sending tracking URLs to their own accounts at that service enough times for the proxy/heuristic to think it is not being used for tracking, then enabling its use as a tracker before sending it to their victim.
No risk of remote code execution though unless some libraries involved in parsing the content have a serious vulnerability?
Actually, unlikely even so. Vivaldi could in fact safely run script in an email, and the only new risk is that the script could send a tracking ping. Scripts in an email are no worse than scripts in a web page (assuming we can ignore the tracking potentials). Vivaldi displays emails with the same engine as it displays web pages, and the engine is good enough to run untrusted JavaScript all the time, all over the web. Emails are displayed inside an about:blank origin, meaning they do not have privileges to interact with any other origin, any more than the same origin policy allows one web page to interact with another (CORS and postMessage being the limit). So if a script can run, it cannot affect any other web page unless the web page itself chooses to allow all other untrusted web pages to interact with it. Emails are also displayed with all scripts actively removed, for all ways that script can be injected into a page.
There are a lot of layers of protection there, and one of them is a fundamental protection applied to all untrusted websites, which is what allows you to use the web safely for browsing.
The reason we disable scripts is because of the potential to send tracking pings, not because we are worried about vulnerabilities.
