So, if I send you a QR code via iMessage the URL in it will automatically be hit, using your IP address and browser/OS details. Wow that's quite an attack vector.
Messages on my iPhone shows me link previews for links sent to me via SMS, not just via iMessage. I just checked to make sure. Those are necessarily generated on the recipient's end.
This could be due to it being sent from someone in your contact list: https://support.twilio.com/hc/en-us/articles/360013199334-Ho...
If macOS really is background-scanning all images, and if Messages.app actually writes all received images out to disk as individual image files, then the background scanning could conceivably scan it. However I haven't seen anyone make this claim, it certainly doesn't seem necessary (why write it out to a file on disk?), and if this scanning is triggered by e.g. Spotlight indexing then it wouldn't be indexing cache files anyway.
So, has anyone actually demonstrated that sending a QR code over iMessage causes the recipient's device to fetch the URL? Because so far this just seems like complete speculation presented as fact.
I have, just now. Nothing happened at either end - the URL was not accessed at all. I can get it to recognise it's a QR code on my iPhone by tapping to focus the image, waiting for the OCR badge, tapping that, and then tapping the image again to bring up a small menu with the URL as a title and headed by "Open in Safari". None of those steps accesses the URL. You have to make a conscious action to access the URL...