It was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent time considering the potential downsides with the aim of making HTML email practical and secure.
HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.
There was one, in the IETF. It went like this: "We should have a HTML profile, somewhat restricted, so that the people who want to send bold and italic and a little more can do that, and composers can know what's okay, and javascript isn't" and a little discussion, and then came people shouting "EVERYTHING EXCEPT TEXT/PLAIN IS THE DEVIL'S WORK!" and the whole thing dissolved due to the noise.
Not sure what you're saying — do you have an actual production MUA with text/enriched support, or is it something else? Send me an example of whatever it is, please. Something with boldface but without HTML.
Just regular Thunderbird rendering some common elements in plaintext mails. Just like e.g. Markdown is rendered on Github. This is what Markdown comes from after all.
HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.