You still have user error to consider -- a user might deliberately choose to load all images by default, or they might click "load all" from the email settings without thinking.

Arguably, this is their own fault at that point, but I'm not sure it's reasonable to expect them to understand the risks. This is why I would prefer click-to-display on each individual image instead of a "load all" button.

Even that isn't necessarily perfect, but it does take you a long way.

An even better solution might be for the email provider to preload images when the email is delivered (not opened), and then either serve them from an online cache when you opened the email, or inline them into the message itself. However, now you're talking about rewriting emails, and I can understand why people might not want that -- it comes with its own set of downsides. It would also probably increase operating costs as well, I assume.