I filed a bug report about this 3 months ago. I did completely agree this is not likely to be a serious security issue (only a few indexed emails will contain phonenumbers or private information, even less likely private as Googlebot must have publicly found these links online, though some message bodies did hint at stuff like password resets).

It is worth looking into from an SEO perspective, site (index) health perspective and to ultimately prevent/minimize problems like these.

In my opinion these links do not belong in the index. https://mail.google.com/mail/ should have been the Canonical. Big companies expose the contents of SMS messages, who contacts who, and sometimes even what their users search for.

Now these pre-filled "to"-field links were picked up by accident with the automated sitelinks algorithm. It could have contained a pre-filled "body" too, maybe some spam or maybe a crude online link to make an appointment and have certain fields filled in.

Webmasters can prevent this by specifying Canonical and cultivating the search index quality by only letting bots index unique quality pages, not for example have pages and pages of user-generated search results (Consider noindexing /search/results/), open redirect link(spam), or indexing every possible way a user may change your URL parameters and posting a link of that somewhere to be picked up by the search bots.