This is a practice that exposes the tension between protecting users from malicious use and privacy at scale. A lot of malicious links get sent over messenger s

This is a practice that exposes the tension between protecting users from malicious use and privacy at scale. A lot of malicious links get sent over messenger systems, and loading them is often the only good way to find out which ones are or aren't. But wait! Surely there are other possible approaches. Can't users just report spam? Surely there are clear usage patterns that can be detected too! These are valuable and useful approaches, but have historically proven unequal to the task. It can be tricky to spot a spam campaign spread over N accounts - only the most basic forms of spam are really obvious. URLs are easily disguised and changed. Loading the URLs and checking the contents that come back is one of the better approaches. Users also don't tolerate a bunch of spam. They will migrate away. So, yes, anyone who makes a GET endpoint into an unauthenticated change-things URL deserves all the misery they get.