In any case I don't think it's a high level security issue; most people would probably implement their own sending by the time it is in production. More like something to think carefully about