That's inherent to features that allow user generated content, which is obviously mandatory in the context of PayPals invoicing feature.

The only reason why companies don't care about it in the context of mail is because there is no equivalent to safe browsing for mails, so Domains aren't penalized by Google for sending fraudulent messages at small scale. If this was to change, they'd all pivot to using secondary domains for these mails, like GitHub does for GitHub pages.

It would also be a pretty pointless feature as you'd probably complain anyway, as the email would still come from a Paypal owned domain.

On the same topic: if you've got a Gmail address you're also able to send from @googlemail.com

Is this another security issue in your opinion?