Apparently, the first time you run Discord on a new machine, it opens a URL with your default browser that, if you're already logged in, also logs you into the desktop app. Without asking on either end.

Which was convenient but also creepy and feels like a security concern. Like, someone can generate a web URL that if I visit it logs them in as me? How is that safe?

(Update: After playing around a bit, it appears that it is safe, I'll explain why in a reply.)