Good catch, yes it is enabled, that’s the default. I just requested it to be disabled, and reported that it is not mentioned in the ToS.
There still are risks but slightly lower as Gravatar limited a bit its API. Note that images are fetched and cached by Weblate so your personal IP address has not been logged by any Gravatar server either.
Gravatar has been disabled already, thanks to Weblate team’s responsiveness.