I remember the days when Outlook used the Word HTML renderer in the background

And why? Because Outlook used to use the IE HTML renderer, which could not be sufficiently restricted. So more often than not, an unwanted feature of IE was also available in Outlook, even when it should have been blocked. Plus, Outlook also suffered from most of the bugs in IE. So switching to probably the only other usable HTML renderer that had intentional limits was actually not the worst idea.

Yes, the HTML and CSS subsets understood by the Word renderer was very different from the IE renderer, and it had its own set of quirks. Oh well. HTML never promised pixel-perfect, identical rendering on all browsers and all devices. Even less so inside the (hopefully) restricted environment of a mail viewer.

IMHO, a mail viewer must not load external resources, no images, no scripts, no stylesheets. It must not support any kind of code execution for the HTML mail (e.g. Javascript, VBScript, ActiveX controls). And it should prevent misleading styling of texts, images, links, and buttons. It also should not support HTML forms. Yes, that limits what can be styled in HTML mails. It makes all kind of colorful, animated spam look boring. But it also prevents spying on mail recipients, automatic actions on the behalf of the mail recipient, and a lot of trickery to fool the user into clicking on malicious links.

Perhaps it would also be a good idea to clearly display at least the domain of all links in the HTML right next to the link. Yes, that would make HTML mails even uglier. But hopefully, it would make people think twice before clicking on a link that pretends to be the link to your online banking or your parcel service.

Alexander