Probably the QR scanner written for the iOS camera has an option to present URLs nicely (by fetching them), and some other OS component for image indexing reused the QR scanner without realizing it comes with side effects.
It doesn't have to be explicitly nefarious to be a privacy issue. I'm sure there's some perfectly innocuous reason Apple could come up with for doing this, but unless and until Apple is forthcoming with those reasons and is transparent in how this is implemented (i.e. by providing source code) I have zero reason to take any such reason at face value.
Transparency is a dependency of trust. Apple is not transparent, and therefore is not trustworthy - especially when it's running a full-blown crawler on ostensibly-private messages.