> for something terrible to happen if they [click links in their email].

There are very few RCEs now on modern browser (they still exist[0,1], though). The main threat is phishing, because users are gullible (and should be educated).

[0] https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

[1] https://objective-see.com/blog/blog_0x43.html

And: https://news.ycombinator.com/item?id=20283922

You don't need to exploit a browser when Adobe still can't fix the holes in Reader and corporate users are still heavily dependent on Outlook.

The real question is why should links in an email message be clickable? Restricting email messages to plain text would make it much more difficult for attacks like that to succeed.

URLs are plain text... Can also easily be clickable, depending on your e-mail software.

They are, but some email clients will display text that doesn't match the original URL. Hence the advice to hover the mouse pointer over the link and tread the original URL text that way.

If you use plain text mode they won't be able to. Hence the advice to disable HTML in e-mails.

... and make emails completely useless.

Ever head of copy & paste?

Won’t make them “useless”, maybe inconvenient for non-security minded individuals.

if You make emails inconvenient for non-security minded people by removing something as important as links, you will push mainstream users to move away of the medium (because other way to communicate will definitely support links and not force people to copy paste), which doesn’t help or solve anything.