You've misunderstood, the email only contains a notification that a new release is out, along with a notice about inspecting+testing code and a changelog. Simil

You've misunderstood, the email only contains a notification that a new release is out, along with a notice about inspecting+testing code and a changelog. Similar to how many FOSS mailing lists work. The actual code is downloaded from either a git or http server, not via attachments to the emails themselves.