In short, yes—confirmation is requried.

Here's an example of a payment link: https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ. It's a single link that can be shared with anybody (not unique to one customer).

On the Stripe side, nothing is collected from the customer til they click.

We've thought a lot about the security side of things—one of the reasons why Payment Links has its own subdomain and the payment page is hosted by Stripe.