This means that if someone logged into the account they can go straight to the iCloud email and delete the warning message, So you wouldn’t know about the login.
Who ? rather can sign in your account from other place unless you reveal the credentials and they will delete the mail .
The point was that the email is always sent to the iCloud email, even though I have a different email set up for notifications.
In mail preferences - composing section if you had selected set new messages from @gmail.com it doesn't matter this is for when you send mail messages to recipients it select this mail address .
The Apple ID example1@icloud.com is signed in system preferences , whenever it is signed on web portal it takes time to appear in web account ( it comes through apple interconnected servers ) and then appears in mail application .
See these screen shots .

