But the only one of those problems that is due to it being a Turing-complete language is the infinite loops, the other ones are just a question of the mail clie

But the only one of those problems that is due to it being a Turing-complete language is the infinite loops, the other ones are just a question of the mail client exposing sensitive capabilities to untrusted code (which it should not do, of course). As for infinite loops, SVG allows you to make definitions and refer back to them, so you can write documents which take exponential time (in the document size) to render --- in practice that is as big a DoS attack. And the way to deal with it is the same, you need to impose resource limits when rendering files given to you by an untrusted attacker. It seems that Postscript the language got an bad reputation for kindof unfair reasons: the toolset was written assuming that files were generated by friendly people, and then those tools were run an arbitrary code from the internet. But it is totally possible to write a Postscript interpreter which runs code in isolation, just as you can for Java or Javascript.