Seriously? There’s a preference called “Display remote images” that is enabled by default because most users will be confused when half their emails look like crap. If you disable this, Mail won’t load any remote content until you press the button.
In proper email and webmail clients, it's off by default and there's a button to 'display images' at the top of the email when you're reading it. Thunderbird, Android's built-in email client, Gmail, etc all do this.
In proper web browsers, such as lynx, displaying remote content other than the HTML is off by default and there’s a button to display images.
Heh. True. But, there's a big difference between surfing a website anonymously and having your mail client on your modern OS sending tracking information confirming your email address and that you opened the mail out to every marketer and spammer that sends you email by default.
If Mail thinks that an email is spam, it doesn't load images by default.
That's really not good enough, though. Lots of email that is spam will get through the filters over time.