Testcase is a signed email (S/MIME) which contains another mail as attachment.
The signing certificate is expired and the sender address does not match the mail address of the certificate. The information in the tooltip of the "insecure" icon reports a not matching mail address instead of the info, that the certificate is expired (which was expected, as that is the more severe issue):

This is so far the same in 5.0.2 and in VSD 3.3.7.

In 3.3.7 additionally clicking on the "Insecure" icon does result in an error message instead of the certificate details being shown:

After klicking OK there, another error message pops up:

I've made logs for both versions but won't attach them here, as the mail is an example by a customer.
The sequence there is: open mail file, click on "insecure", close the window(s) again which open after this.

This ticket is at least 2 issues rolled into one, we'll have to sort this out later and maybe split off parts of it.