When I used Alpine, it was talking to IMAP and definitely segfaulted a couple times. But an RCE in Alpine != RCE in Postfix (great architecture). I dunno MUAs are so personal, they feel like a perfect place to target and handle more edge cases than upstream processes.