Replying to @can and @zeynep
It's hard to fully defend with an app inside the network, but in the case here it's possible to improve on Safari + guest chromebook. With stuff like Brave or a PiHole (or Tor, but there may be limits 😁) the link wouldn't have been made.