Firefox.com is owned by Mozilla corporation.
Thunderbird.net is owned by the Thunderbird project / Mzla technologies
GeoTrust is an Audited encryption certificate purveyor with a huge web presence that is a subsidiary of DigiCert, a larger certificate and PKI company.
If you have software identifying either an malware sites or some other imagined bad sites then I suggest you get rid of it. This is course unless you suspect Thunderbird or Mozilla of nefarious intentions in which case you probably want to remove their products and use another mail client and browser.
Why does Thunderbird try and connect to the web? Because significant part off it are web pages. That is why there are so many external preferences loaded in the defaults.
Another response on this site states https://support.mozilla.org/en-US/questions/1251590 detectportal.firefox.com is used to detect captive portals on public wifi networks to be able to redirect you to their logon screen, so you don't just get page loading errors in firefox (set network.captive-portal-service.enabled to false in about:config in order to disable that feature). Thunderbird ises the Fireofx code base and will be doing the same of web pages.
I would guess without trying that status.geostruct.com is an attempt to verify the legitimacy of a geotrust SSL/TLS certificate issued by probably your mail server as Thunderbird.net uses lets encrypt and Firefox uses Amazon. I assume your connections are encrypted. Probably prompted by the setting Query OSCP responder servers to confirm the current validity of certificates.
I clicked the link you posted to thunderbird-settings.thunderbird.net which gave me a link to https://docs.kinto-storage.org/en/stable/overview.html where I read
At Mozilla, Kinto is used in Firefox for global synchronization of frequently changed settings like blocklists, experimentation, A/B testing, list of search engines, or delivering extra assets like fonts or hyphenation dictionaries.
Given Thunderbird is built on the Mozilla platform, I think we have an answer.
All I can say is in this day and age, software calls home extensively to report telemetry, load web pages and download settings appropriate for certain actions like configuring an account. TRying to prevent that is really limiting the software ability to function as a fairly basic level.
You have listed three of perhaps twice that number of sites Thunderbird will regularly connect to.
On startup it will load a web page from
https://live.thunderbird.net/
Opening the addon page will load Thunderbird.net pages as will viewing the release notes, or any of the entries on the help menu except about. Some open in a browser window, others open internally to Thunderbird. I have no idea what exact connections are made and I am not aware of any list or page that monitors them.
Checking for updates is not optional, The team do not want folk using old versions of the software as it exposes them to increased security risks as each version contains security enhancements. Updates can be managed in corporate situation using group policies. Otherwise stand alone users are limited in their options options to automatic install or not.
I won't post the user's reply to that (it is a bit lengthy) but he's not happy with the response. He just wants an email client that will connect to Google' email service using oAuth. As he says, he already has several web browsers and doesn't need another. He just wants his email program to do email and that's all, apparently.
I think maybe the Thunderbird developers have some explaining to do, particularly with regard to why they are forcing telemetry on users and giving them no way to opt out.
Thank you