And such was the case for a man who snapped a photo of his own child to send to the doctor which got uploaded to his Google photos resulting in his Google account of over a decade getting shutdown for CSAM.
As another commenter said, you're not chatting with a friend; you're chatting with Big Tech.
If the doctor was not using a gmail account, the UI probably recomended to share it "with anyone that has the link" that is like public but protected by oscurity.
Most people don't realize that it is 99% like posting it on Facebook.
The URL may be logged by the ISP, university/company or whoever is providing the connection, antivirus, windows recall, browser history... But IIRC passwords are send using cryptography if the site uses https.
The URL is sent using http inside the https connection, so it's encrypted too. Your ISP shouldn't be able to see it unless they have root certs on your device.
It's not impossible that someone sees the URL, and if it's stored in an email the backups or local clients could store it plaintext, but I don't see how the URL is any more likely than the password to be sniffed during the connection itself
Its nothing like posting it on Facebook. Google doesn't have a recommendation engine that tries to share the image with random people, or a search that image will appear in, or a set of subscribed people who will be notified.
As another commenter said, you're not chatting with a friend; you're chatting with Big Tech.
How much do you love Big Brother?