Comment by viperscape

Magic links are susceptible to man in middle attacks if your DNS is compromised, like on public WiFi, because the reset token is in the URI itself. So you're most vulnerable when you click the link.