Is it? One could argue that Evolution developers do not ship an end product, and that it's distros - Debian, Fedora, etc. - who ship the end product by combining Evolution at version X with Webkit at version Y, and possibly patching both.
1. Fixing the insecure library
2. Getting somebody else to fix the insecure library
3. Switching to a different library that isn't insecure
4. Patching over the problem in your application so that the insecure parts are no longer insecure (Santising and stripping html before passing to Webkit, as many, many other email clients do)
5. Warning the users about the problem (A "do not rely on for privacy" notice next to the feature in the UI, with a link to more info)
Evolution Mail wont do any of this. They don't accept any responsbility for the problem. They submitted a bug report to the library and then sat on their hands. If this is still a problem a year from now, they will still accept no responsbility and still claim there is nothing they can do about it, and their users will still be suffering from the problem with absolutely no knowledge about it.
I find it astonishing that anybody thinks their approach to this is acceptable, or even normal in the software industry. It's totally bizarre.