I'd disagree that security == transparency. You can not have security without transparency, but you can certainly have transparency without security.

As for the idea that they are "phishing for active mail accounts", I find that pretty far-fetched to be honest. What use would a vast list of email addresses of normal people be of use to them? To spam them?