I would really like to know this as well. I use gmail, which by default blocks images from loading unless explicitly allowed. I would be pretty upset if I knew that people could insert hidden iframes and achieve the same goal without it at least prompting me. Unfortunately I can't seem to figure out how to write html email from the gmail web interface and I don't feel like installing an email client just to test it out.

Just tried it in Thunderbird with a gmail account, it doesn't render the contents of the iframe unless you click the "Show remote content" button.

Interestingly, will then display images if that is in the src attribute but still doesn't render https://google.com.

I'd put money on this being fixed/removed/blocked in 7.0.4/7.1.