“An attacker can modify victim’s Mail configuration including mail redirects which enables takeover of victim’s other accounts via password resets.”
Mail unzips attachments the moment they arrive, before you read anything. A leftover symlink in a shared temp folder hands the attacker write access to your whole Mail directory. Add a forwarding rule and every password reset goes to them. Apple fixed it in July 2020 and nobody heard about it until now.