[amacneil]

They don't need to be - this is a limitation of how the site has implemented magic links. When implemented best, clicking the magic link in your email should simply confirm the authentication, and your _original_ browser window/tab should be signed in.

That way, you can be signing in on a desktop browser, click the email link on your phone (or a different browser sandbox), and the desktop window will be signed in.

[ignoramous]

An adversary prompts the website to send you a magic link. You happen to click on it by chance. Guess who has access to your account?

As others have pointed out, either login when the user has both generated and clicked on the magic link from the same IP (browser, where possible), or use magic codes (as opposed to links).