It all really boils down to one thing: the Evolution mail client makes a promise of protecting your privacy, and then fails to uphold that promise. Whether the fault lies in the WebKit project, somewhere in the GTK bindings or the Evolution client's source code is utterly irrelevant. Instead of throwing their hands in the air and hoping that WebKit maybe fixes the issue one day someone needs to take responsibility and mitigate the issue.

Of course these are probably unpaid volunteers just hacking on open source so I don't want to dunk on anyone in particular. But as a whole the GNOME project positions itself as a competitor to proprietary software, and this sort of myopic security attitude to the end product does not inspire confidence in their offering. It should not come as any surprise that people giving you full access to their inbox will warn others about the known insecurity of your product.

I think I'll stick to Thunderbird, where security reports aren't met with such indifferent handwaving. But you can keep engaging in academic thought exercises whether the bug should have been reported by the blessed Debian maintainer or something.