[Calzifer]

Because zsh has usually the url-quote-magic feature enabled which automatically escapes all special characters typed or pasted if the current argument is identified as URL.

[jwilk]

Most likely it escapes enough to prevent code execution, but last time I tried it didn't escape all special characters out of the box:

https://news.ycombinator.com/item?id=29071196

[turtleman1338]

$ also gets escaped automatically for me if pasted