The link itself becomes the entire access control
A share link grants access to a specific resource to anyone who holds it, without checking who that person actually is — a deliberate tradeoff of identity verification for the convenience of not requiring the recipient to have an account or log in at all. Once created, the link itself is the entire access control: anyone it reaches, whether through a deliberate forward, an accidental copy-paste into the wrong place, or exposure through a compromised inbox, gets exactly the same access the original, intended recipient had.
This makes a share link's actual, practical security depend almost entirely on how well it stays contained to its intended audience — considerably harder to have real confidence in than access controlled by verified identity, since a link is trivial to forward and, once it leaves the original sharer's hands, there's no reliable way to know how far it's actually spread.
Revocability as the practical mitigation
A revocable link — one that can be individually disabled after the fact, rather than one whose only real control point was the decision to create it in the first place — meaningfully bounds this risk, since the sharer retains some ability to cut off access even after a link has already been distributed. This only actually works if the resource genuinely checks the link's current validity on every use rather than treating it as a bearer credential valid for as long as its bytes happen to be correct; a link that isn't actively re-checked against a current, revocable state is functionally permanent regardless of what a revoke control claims to do.