Concur with
@russell_314, and
@chadamorrill; you're probably fine. Partly because the OP was paying enough attention to avoid further disclosure, partly because
"It’s not going to magically obtain the password for the email it’s sent to" is correct, partly because mail/safari on both iPadOS and MacOS is reasonably tight by default, and partly because I like russell's avatar pic.
I have a policy (and indoctrinated wifey, too) to NEVER click on any link in any form of messaging, even from people or companies I recognize. ALWAYS use your own known-good bookmark to go a site, then ferret out whatever the message might have said.
You can't trust the MEDIUM of messaging generally, let alone companies and people who might be pwnd by man-in-the-middle hacks. Furthermore, lots of companies themselves sell their own customer down the road to make a buck.
Where I work, all inbound and outbound eMail is converted to plain text, including hyperlinks. Full eMail headers are transcribed to a sort of "Footer" after the message. All graphics or attachments (including 1-pixel tracker bugs), inbound and outbound, are forked off to a sandbox where they're scanned (sensitive words, suspicious geolocation, domains, weird use of unicode and foreign character sets) before downloading.
Apple is missing an opportunity here, with their constant yammering about security and privacy. Apple should add this kind of "Screening and Transparency" mode to Mail, though they'd need serious upgrades for sneaky content analysis. Then let the EU chew on that.