1. The emails are not end-to-end encrypted.

2. Google retains full access to the email even when you set a self-destruct timer.

3. If you password-protect an email, Google can link your recipient's phone number with their email address.

I think those are valid concerns. Don't you?