In my opinion, a link - as clickable by a user - should never be able to mutate the state of the system.
However, as the article points out, this analogy breaks down once you go beyond basic HTML and into complex UI layouts.
You'd need to do this for practical reasons too, considering links in e-mails might get automatically fetched whether for malware scanning, caching or generating a link preview, and it would erroneously trigger your verification workflow.
What I was really trying to go for with "state" in this context was something more like "business state". Things on the server that you change and can see with a refresh on a different client.