It is the first one, they need to be printed and clicked.
The hypothetical new control code is different because it does not display a hyperlink; it directly opens the link using the appropriate system URL handler.
[0] https://gitlab.com/gnachman/iterm2/-/issues/10994It has a massive and rapidly growing attack surface and quite a bit of feature bloat (literally hundreds of "features") - I would not recommend using it over Terminal for anyone security minded.