Not surprised. I even made a privacy preserving proxy plug-in for Coral Talk, a comment system, that would hide the gravatars behind an UUID based parameter [1]. This was quite some time ago. I understand why Gravatar would choose to expose avatars using a hash of an email, but they could have used a more expensive hashing function.