@konklone, I’ve stumbled across some issues concerning the adoption of privacy in Discourse, too and have learned that the Discourse team is adopting a kind of “post privacy era” point of view towards them.
I don’t think the issue of security is too relevant here (although such a single point of attack makes the target very promising - to an attacker, the avatar service would provide leverage to compromise Discourse installations around the globe).
The privacy issue, however, is quite an obvious one which is even worse since world-wide, the legislation concerning privacy for online services differs hugely. This can make the use of Discourse difficult or even cause legal problems for the site admins. My wish would be that at some point in the future, such privacy concerns will be taken into consideration more seriously.