Right, if a user is worried about this the onus is really on them to ensure that their browser has referrer-sending disabled.