Any time you provide a vector for an attacker, you run the risk of being exploited. Email is even worse than web browsing, because an attacker has the ability

Any time you provide a vector for an attacker, you run the risk of being exploited. Email is even worse than web browsing, because an attacker has the ability to send it to you, rather than waiting for you to go to their site. I would never claim to know my email-renderer so well that I was 100% confident that it didn't have any attack vectors, particularly with all the crazy things you can do with unicode nowadays - much more straightforward to just read it in a virtual-machine. That way, even if you guessed wrong on the attack surface of your email client, the damage is contained.