Haha thanks @NHeath1!
I found this too recently, that internal marketing email in workflows can be sent to any address. I am also scared of them patching it.
The solution I adopted is - created internal email groups of different teams and tools. Later, I added those email groups on Hubspot as a team member. We had a dozens of external email accounts that needed to recieve notifications, now we only have 2-3 grouped by their team, function, etc.
Like - development@mycompany.com sends email to our development team.