I have an email from 2015 where I reported this as a potential vulnerability in the Hartl Rails tutorial, having seen it myself back then. Consider "verified" ashley madison accounts in their breach and this scenario.

This is not just a Gmail thing. Most corporate mail filters visit a link and scan for malware as a feature.