Even more worrying, I just went into the settings and toggled on "Block remote content" and then sent my self another test through https://www.emailprivacytester.com, and it still triggered a remote content load when I viewed the email.

It's saying that the images were blocked, but that didn't stop them being fetched. Entirely defeating the point of the setting.