I believe that the default behavior should be to never open a link without a confirmation from the user that this may be done.
This should be enough to avoid malicious links. I do not believe that completely disabling links is a good default, because they are very frequently useful when you read some text file in the terminal window.
I don’t want random text in my terminal to be a link. I do not find that useful.
If people want it enabled, they can enable it. It shouldn’t be the default.
Yes, I agree. Ghostty et al don't open-on-click, but on hover they'll show you the URL and there's a keyboard shortcut + click to open. This is much better UX than disabling OSC8.