Digging through developers.facebook.com, it appears that their link scraper creates Objects in their Social Graph. Because these resources are accessible by URL, they are considered self-hosted objects, and they're always public [1]. Their Link Sharing FAQ mentions that Messenger is one of the ways link previews are created, further confirming this behavior [2].

Really the problem is that several situations coincide which make the result surprising:

- It's not so bad that posting URLs to Facebook generates a link preview and saves that as a public resource in their Object Graph.

- It's not so bad that you can find the Object's object-instance-id by the URL.

- It's not so bad that Facebook correlates a bunch of information about that Object's relationship with other nodes in their graph.

- For data they believe is all-public, it's not so bad that object-instance-ids are not cryptographically secure and are trivially crawlable.

But when taken together, it -is- surprising that URLs shared through Messenger (a setting that most users would assume to be "private") can be trivially crawlable.

[1] https://developers.facebook.com/docs/sharing/opengraph/objec... [2] https://developers.facebook.com/docs/sharing/webmasters/faq