The obvious solution here is to not merge the whole thread into your email, instead including only the parts of the message that are directly relevant.
Insecure in what manner?
To me it's no more insecure than a VCS - sure, anyone could edit anyone else's code, but version history was always there.
(but it's read-only, there's no rebasing, people still use old-school e-mail clients)