In proper email and webmail clients, it's off by default and there's a button to 'display images' at the top of the email when you're reading it. Thunderbird, Android's built-in email client, Gmail, etc all do this.
In proper web browsers, such as lynx, displaying remote content other than the HTML is off by default and there’s a button to display images.
Heh. True. But, there's a big difference between surfing a website anonymously and having your mail client on your modern OS sending tracking information confirming your email address and that you opened the mail out to every marketer and spammer that sends you email by default.
If Mail thinks that an email is spam, it doesn't load images by default.
That's really not good enough, though. Lots of email that is spam will get through the filters over time.