I think there is a greater risk for nostr clients, since people can inject this stuff into your feed. Mail clients have the same issue and have “dont load images” for this reason