Yes, a link requires user interaction. But what if the attacker decides to render an image instead and put the secret data in the query params? Loading an image is a way to trigger a request without user interaction