Maybe they would at some point send an email offering to turn off these annoying notifications with a malicious URL?

Very questionable. Some people will come to completely ingoring them (which isn't good either), some will click anything out of being too annoyed. Whatever, people can be manipulated into doing some statistically predictable actions with decreased awareness this way and this is a vulnerability.