“Details of the vulnerability haven’t been publicly disclosed, for fear that it will be exploited.”
The entire job of Hide My Email is to hide your email. A researcher says every address he tested could be unmasked. Apple sells privacy as the product and charges a subscription for it, so a feature that silently leaks the thing it hides is not a footnote. The details are being withheld because the fix apparently is not out, which means it is still live while you read this.