I have tested an image generated with this script in both Gmail and outlook clients and it works just fine. Else I wouldn't post it over here of course :)
You're right. Google changed the way they did images a while back to prevent email image marketers who used to track when the user opened an email using a 1pixel transparent image downloads.
"1x1 transparent pixel" is called a "tracking pixel".
Gmail still allows marketers to track when a user opens an email (even better than before, since it no longer asks users whether they want to load images). However, they proxy the request so that the tracking pixel host no longer gets the user's IP address or third party cookies.
Then don't open spam? I don't think a spam email has made it to my inbox in almost 5 years. Google's proxy protects your private data and only informs the sender that the email has been opened. I would hardly call that "unsafe"
They changed about two years ago to run all images sent to a gmail address through their servers (and presumably store them). It specifically didn't effect marketing though. I was working in email marketing at the time and there was some temporary gnashing of teeth but this was not much more than a blip.
From my testing, it seems like Gmail will cache via its proxy, but that cache respects the cache headers, so you can instruct Gmail how often to refresh the data.
(That, and you can cache-bust on a per user basis using a unique identifier in the query string.)
Few month ago I tested this,
and it's seems they do not cache. Instead they are just using proxy to enable anonymous download of the image.
But you never it any cache from google directly.
They do cache at least sometimes, and they must for it to work.
If I send you an image URL http://example.com/fH27cAw, and they URL is requested, you must have opened my email (unless something is requesting them regardless).
Actually, I implemented this very thing in C# on top of weather radar imagery back in 2006 (to be able to overlay real-time weather on a 3rd party mapping widget), so I've given the entire concept full consideration already.