>That should be the default behavior

It is! The phishers try to socially engineer their way into getting link previews or in fact clickable links period.

Screenshot here of the automatic link/preview disable-

https://www.bleepingcomputer.com/news/security/phishing-text...

I tend to agree.

But how does that prevent one from receiving and opening a malicious message?

Because many people know not trust unknown senders.

I should have said “a well crafted malicious email” or SMS etc.

No such thing as completely idiot proof. But I think we can all agree an exploit that requires a click is a lot better for the intended victim than one that doesn't. This way they at least have a chance to not click it. Then we can start tackling the other problems with separate solutions

Phishing is big business and ways to combat are not fool proof. Education helps. Spam detection helps.

Education helps, but it puts the burden on the user. The real fix is shutting down the phishing source, not just filtering the symptom.

You know that E-Mail clients blocking stuff came after right?