Don't cursor and vscode also have this problem?

Probably all of them do, depending on settings. Copilot / vscode will ask you to confirm link access before it will fetch it or you set the domain as trusted.