A reasonable trade-off would be disabling parsing for people not in your contacts list.
For the general population this probably applies, but in the case of this exploit it looks like it's targeted at specific individuals. If you were someone being targeted by an oppressive government, for example, you might be a bit more cautious when clicking on suspicious-looking incoming media so I think the suggestion has value.
Fair point. The point still stands but in a weaker way though. Even people who say/claim they care make mistakes.
The idea is that contacts can still send you media without prior approval. Do their children never make mistakes? Do their spouses/gardeners/etc.?