Yes, developers have known about this problem for years.

But Gravatar and sites using Gravatar are terrible at explaining these risks to less technical users. Those users have an expectation of privacy when a site claims they won't share their e-mail address with anyone. No one has told them how incredibly easy it is to verify that their user account on one of the sites they use is the same person as a user account on a different site.