Not so sure about that, a quick search through my emails reveals emails from mend.io and codesandbox.io that had no trouble getting to me.

That said, I have found that even some sites that have .io don’t have it in their emails, they use a slightly different domain.

So maybe some sites have been whitelisted or it’s one of many heuristics Google uses.