That seems different? Exposing (possibly private) URLs in messages via the API seems like a bug (though int64s aren't really guessable when you have DoS protection).

Just visiting the link shared is completely normal behavior.