The concerns you raised in all honesty can be said about any piece of software that you install. Browsers for example could use a similar method to capture login details for any site you visit. In fact in this instance many people already trust their browser with those details (firefox and Safari already store form fills as well as stores login credentials as do many other pieces of software).
The biggest potential for vulnerability with email clients is more in the configuration than the trust of the mail client. If for example you do not configure the mail client to use SSL or TLS then the traffic is sent in plain text.
Potential Issues With The Client
The first potential issue with the client is as you suggest. It would be a trivial task for a mail client developer to implement such a method as to send your credentials to an outside source thus capturing those details for nefarious means. If the client is a well known piece of software then this is unlikely. If such a feature was found it would destroy the reputation of the software and the developer.
Another potential would be for a plugin or malware to have similar intentions. Again if it was a legitimate plugin their reputation would be destroyed. Malware developers on the other hand would not really care.
Another potential issue could be if your mail client did not properly use encryption methods or used a non encrypted connection as a fallback. If this happened then the traffic between your client and the server would be sent in plaintext and would be trivial for someone in the right place to be able to retrieve your login details (hence why you should never use unencrypted connections on open WiFi connections).
Lastly another issue that could occur would be if for example someone managed to carry out a man in the middle attack. If they were able to modify your client machines DNS they could essentially redirect traffic to their server and capture the details this way.