Well... maybe I'm being too hyperbolic. But, I am under the impression that Safari is still the default handler for http things. So, links from the mail app or maps will open in Safari. I don't think it's that outrageous to suggest that malicious links have ever been sent via email.

We can all sit here on HN and say that you shouldn't just go around clicking on everything that arrives in your inbox, but phishing is still something that banks deal with.