I think the major problem here is that this information was sent *by default* and many websites didn't realize that outbound links where sharing the source URL.

I think the major problem here is that this information was sent *by default* and many websites didn't realize that outbound links where sharing the source URL. This could result in an exploitable security issue. Now the website has to do something explicit to share information (beyond the hostname) to outbound cross-origin outbound links. It is much more likely that the website will pay attention to what information they are sharing in this case.