Link is not HTML specific. Content-Security-Policy can also be specified as an HTML meta tag, that's where it belongs. CSP obsoletes X-Frame-Options which couldn't be specified as a meta tag only because MS made up that rule when they made up the header, with no justification for it. Everyone followed suit simply because that's what people had to do when MS had a stranglehold on the internet.

I'm sure there are other examples of HTML specific HTTP headers that can't be specified as meta tags because we're still stuck with a lot of crud, but that doesn't mean they're not out of place too. It's just the wrong layer for that data.