Add an option to disable metadata retrieval / make it opt in
Music album art appears to be pulled from remote locations, without any warning or ability to disable. It could be considered a privacy issue, since it likely requests information from a site whenever a music file is opened, and the request could reveal information about the file (although I'm not aware of the actual implementation so I could be wrong). This wouldn't be an issue if the fact that this occurs when they preview music files is made known to the user and they can opt-out, but this currently isn't the case.
Remote content can also be accessed when previewing a .html file which can of course contain anything - which is a possible security concern for avid users. It may be sandboxed but some users might not want to take that risk and either way, some might just want local functionality only.
A possible solution would be to prompt the user to allow metadata retrieval when it would first usually be collected when previewing a file. This would be ideal since it is opt-in. But if not that, then I think there should at least be an option to disable for users who don't want this functionality.