Based on that linked thread, it was off by default, mentioned there might be privacy implementations, and contacted the domain itself (which I would not classif

Based on that linked thread, it was off by default, mentioned there might be privacy implementations, and contacted the domain itself (which I would not classify as a third-party - that's the service that is in control of the email address) to retrieve its favicon. That seems more than reasonable to me (off by default, with a warning!), and would be exactly what I would expect the app to do if I did enable favicons.