Tracking and "publicly indexing by hitting the link with a search crawler" are two different beasts. In the latter case, beyond the privacy implications of a search engine publicly indexing logged-in pages, wouldn't it make magic links useless if the website discards login tokens after the first use?