It's not super hard to imagine a parallel universe where any software can copy to the clipboard but only the OS, upon user request, can paste back out of it. And yet here we are wallowing in filth. Why, because people have never heard of a callback before?

Let the application include a "paste" handler function, and then all clipboard exfiltration must be initiated by the user at the OS UI layer. Simple. Safe.

example: if you copied twitter://foo/tweet/bar or https://twitter.com/foo/tweet/bar, it checks your clipboard and loads that tweet instantly

at least that's what i read over on reddit about this on r/apple