Just a quick follow up…
I went ahead and reported this issue, but I implemented a quick fix that suits my needs. I simply swapped the two variables on either side of the logical operator on this line of code (because I always want the configured “from” address to be used if it’s defined).
As an aside, I also learned there are two default “from” addresses used in transactional emails. ghost@[blog.url] is used for admin emails, and noreply@[blog.url] is for users / members.