You should not allow for state to be changed in a meaningful/dangerous way using either URL schemes or deeplinks. Apple gives the following warning:
URL schemes offer a potential attack vector into your app, so make sure to validate all URL parameters and discard any malformed URLs. In addition, limit the available actions to those that do not risk the user’s data. For example, do not allow other apps to directly delete content or access sensitive information about the user. When testing your URL-handling code, make sure your test cases include improperly formatted URLs.
While this is aimed at URL schemes, Apple still does not guarantee the authenticity of any incoming URL based launches (as shown by the deprecation of the source attribute). If you need to communicate securely between processes, you should use an App Group entitlement to direct the system to create a secure, shared sandboxed environment for a specific set of applications your developer team has created. If you need to communicate something between processes, you can write a message file and then launch the other application by its URL scheme and direct it to try and parse the stored message. This is secure as no false messages can be injected without compromising the iOS sandbox.