It was promised from its first technical preview that it would eventually have a built in mail client.
It isn't "bloat" any more than a screwdriver on a Swiss army knife is bloat. It's one of the key features of the browser going forward. If you believe browsers should not have built in mail clients, well, that's why alternatives exist. It's Vim vs the IDE debate, at some point you just have to accept that some people want the bare bones editor and some people want the full featured experience and there's nothing wrong with either approach.
Opera used to have notes and I doubt they ever had a CVE due to it.
I'm not fully sold on "doesn't belong in browser" - arguably, it the browser is almost like an OS, it is not far fetched to ask for such features. I guess that is also what ChromeOS does.