Ok, but a sufficiently bad constructed message woul force me to do something to retrieve interesting “actual” content? That is what seems wrong.
Clients can (and do) use trust scoring to activate AMP in emails. Right now they use the same model that would allow loading images by default.