I think we should disable the welcome page it fetches from Thunderbird’s website to minimize attack surface. Sure it connects over TLS, but this isn’t secure in certain threat models against advanced adversaries.
We can replace it with custom project art instead or just opt to retire it completely.
mailnews.start_page.enabled -> false