[Benedicht]

My guess is that nefarious implementations already could do a lot of questionable or outright illegal things.

[everforward]

Yeah, but I think it's worthwhile to try to stop it where possible. URL previews are insignificant enough that it makes more sense to me to just not render them than to render something potentially incorrect. I'd rather not get a URL preview than get one with no confidence that it's correct.