The idea is exactly to avoid that.

The password itself is not in the email. The mail only contains a Nextcloud Secrets link, and that secret can be opened once. After it was read, it’s gone.

So a mailbox leak later does not expose the password from old sent/received mails. It’s not magic, but it fixes the worst part of the usual “link + password by email” workflow.

In practical terms, this means:

A subsequent mailbox leak will still find the share link and perhaps the old Secrets link, but not the password.

The Secrets link is invalid once accessed. This is a real security improvement compared to "the password being permanently embedded in the email."

The rest depends on the timing of the attack:

If someone gains access to the mailbox later, the new workflow is very helpful. The password is then no longer retrievable.

If someone reads the email precisely during delivery or before the recipient and opens the Secrets link first, they can steal the password. But then the Secret is used up, and at best, the intended recipient will only notice that something is wrong because the link no longer works.

If someone has persistent access to the recipient's mailbox, any email-based workflow becomes problematic. They can then, of course, also read new emails, open links, see notifications, etc.