If you get a suspicious group link sent to you, the only thing you can do is report the group link creator as a spammer. If you click the link and don’t report the creator, then yes, there could be a mix of attackers and victims in the group, and you will be sharing your profile.
Why can’t you click a group link and report it as spam (i.e. just the creator of the link) before you share your profile or see anyone in the group connection?
I agree, the other attackers in the group could avoid being punished for spamming, since they would only appear once the victim has already shared their profile. Is that your point?