I guess that if they consider it a vulnerability, they're going to do the check on the server side... I really hope they don't though.
If they do, I'll fix it on the extension (so only people with the extension would see the markdown links as real links).
Also: to answer your question... yes, there's an undocumented way of sending them. And yes, the client escapes `<https://url.com|the title>` to `<https://url.com|the title>`.
The format is the same format used by bots to generate links.