Apple's "Protect Mail Activity" Doesn't Work

Turn both of those on. Now you have the best setup offered by Apple. No network requests are performed automatically, even if you read the email.

That's not true, I tested it very recently: https://lobste.rs/c/snk7zz

Apple Mail on iOS triggers DNS prefetch, even with hardened settings.

I don't use "hide my ip", I just never load remote content.