When looking at attack vectors the possibility to click on a link is one of the important attack vectors for mail.
I would recommend a optional function where a user can turn off link clicking completely.

—

Like others suggested you could in addition provide a option where you still allow to copy a link with a button.

Another good suggestion I saw was to highlight the domain within a link

In combination with disabling content loading this will be very effective to mitigating most threats.

Finally you could make a function where users are give the option to scan attachments via virustotal

I belief these additions would be very usefull