They don't necessarily. Thunderbird lately makes me opt-in, or whitelist a particular address if I want. I haven't dug in to ensure that it's 100% rigidly shielded from all possible info leaks (e.g., "blocks img and script but still loads bgsound tags", which is an example of something I've seen before), but it's definitely at least trying to not load by default.