We have about 500ms to make our assessment so we wouldn't follow a link in realtime and depend on it resolving and redirecting etc.

Instead we expand them later and visit and scan them after the fact. But at that point the email is often already delivered.

But bottom line url shorteners are so abused as to be a de facto sign of spam.