Apple should fetch the data via their servers instead of the clients'. It leaks way too much information.
A good approach would be for the sender to fetch the URL and embed the preview as metadata along with the message. The only downside is that the sender could spoof the preview, but I think that's an acceptable trade-off here (not much of a phishing vector when you end up loading the original site once you open the link anyway).
Ha. Cute.
At the end of the day this privacy trade off (apple gets your browsing info) is probably more secure than an embedded webview that could potentially be exploited and is auto-loaded. Similar to how Chrome alerts of malicious sites...I see this as a long term larger attack vector than privacy leakage.