They intentionally provide this information to marketplace sellers. It's arguably poor design but it's definitely not an unintentional security flaw. Marketplace/FBA sellers have talked about strategies for utilizing customer email address for years [1]
[1] https://sellercentral.amazon.com/forums/t/how-to-access-all-...