~snip~
Even for firmware upgrades or software updates, I don't trust the apps notifications. I just go to their official website by typing the address and update my software. Because on Electrum we have seen how scammers were able to send notifications on the apps that force the download of fake software or malware. So always need to verify the official sources. Because it's related to the funds, and we need to be very careful.
Isn't it easier (safer) to save the original link to your favorites and then use it every time you need it? Typing an address is error-prone and just one wrong letter can lead you to a phishing address.
Sending messages via e-mail and exploiting a vulnerability in an official app is something completely different. What hackers did with Electrum 7 years ago, if I'm not mistaken, was truly brilliant (for them, of course).