tl;dr - Slack’s permission model lets apps read and preview any link shared anywhere in the workspace, including in priv
Harvesting Links in Slack for Fun or Profit