This is a bug in the app, I don't see how it is Android's fault.
This sort of fault shouldn't have been allowed to pass.
The user has to agree to use that app to open http links.
Sure Google could kick this dev butt and ask them to use a more focused intent filter but that's way less of an issue than an extension siphoning all your web browsing.
"The app" does not provide the share intent panel functionality, the framework does, and even if there was some way in which an app could be thought to be to blame, with what permission would it be inserting its resources in a particular spot in the panel?