If this is a problem, why is with Superhuman and not the client at the receiving end? How tracking pixels are handled is a client issue. If anyone's violating your privacy, it's your email client and not the sender of the email or the sender's email client/provider.
I think it's analogous with EU's "cookie consent". Cookies too are a client issue. Instead of annoying mandatory popups on every site, browsers should handle cookies better by default.
In this case the lock would be shipped broken from the factory with the users and lock manufacturer's knowledge and consent (with regards to email clients' and web browsers' default settings and the user's ability to change these).
I think it's analogous with EU's "cookie consent". Cookies too are a client issue. Instead of annoying mandatory popups on every site, browsers should handle cookies better by default.