So on my private personal account (not the ones I use for important things like banks), all HTML email is filtered directly to /dev/null.
That's caught exactly one personal email I'm aware of in ~15 years (I forget exactly when I added that to procmail). It might have hit others, but it is a far better false-positive rate than any other individual test.