The payment URL link requires a token when you're not logged in, which is encrypted data included in the URL. No one will be able to guess it to try to steal account information from the "Copy Contact Information From" option. It is much more likely that someone could intercept the email and follow the link themselves instead.
You can update the Invoice Delivery (Unpaid) email template to remove the link to {invoice.payment_url} and define a link yourself to {client_uri}pay/method/{invoice.id}. The client will be directed to login, after which they will arrive at the Make Payment page to pay for that invoice.