Well, of course something is being displayed: the http:// or https:// URLs that I inserted into my original email, as well as the JS redirect code, which could be effortlessly read -- and almost as easily altered -- on its way to the browser.
If an email links to https://www.example.com/my/product/page/?some=query a marketer would reasonably expect the pathname/query to be secure on the wire. But it isn't, because it bounces off the insecure branding domain. To be fair, there isn't deeply sensitive information transmitted in our clickable URLs. But we do sometimes include tokens w/ the Salesforce and/or Marketo ID for the lead (for later API work) and it stands to reason that we want to keep those tokens as secure as was the original URL.
More important, though, an interested (and only marginally skilled) hacker could alter redirects to go wherever s/he wanted. Imagine a classic phishing attempt with a lookalike login page, using as cover the lead's/customer's existing comfort with our brand (and the fact that the mail was DKIM-signed and SPF-passed to boot). I know this attack vector sounds crazy to most Marketo users, but any targeted attack, especially such an easy one to execute, is something we need to cover.
(Turning off tracking isn't a solution because obviously we need that functionality.)
.png)