Do you know those "Login with Facebook" and "Login with Gmail" buttons all around the web? They are almost the same.
When you allow someone to login with their Facebook account, you are validating that the person have access to that Facebook account and in no way confirming his identity. That confirmation is being delegated to Facebook.
A magic link does essentially the same. Opening the link does confirm that the user have access to the email, but the authentication is being delegated to his email provider.
Anyone who knows my email can request sign-in link on my behalf
People that know your email can try to login on your behalf, and they can do exact the same on your email provider. And on any service on the internet. Being able to try to login isn't the same as authenticating themselves, so it makes no difference.
They won't be able to login because they don't have the link, and if you click on the link, you are logging in, not them. So it does not matter.
Can this be used with public emails like Gmail, Yahoo?
They are not public emails. I have a Gmail account and I am pretty sure it isn't public. A public email would be those disposable emails (like Mailinator, for example).
A public email from Mailinator can be read by anyone, so if your service says "The link has been sent to email@example.com", anyone can just get there and grab the token.
But if the token is sent to "firstname.lastname@example.org," only the owner of that email can access the token. And it makes no difference if the email is from Google, Yahoo, or the White House: only the one (or ones) with access to that email can have the token.
If this is considered a form of authentication, can it be compared to the auth_code authorization grant in oauth?
If the token cannot be reused, it's the same as OAuth.