Comment by kro

Yes, if it requires the user session (xss related), like the article, there is no problem.

I was replying more generally about the "don't click links" advice and cases of server generated confirmation-token links (not saying this was the case at OpenAI)