Drupal Association members fund grants that make connections all over the world.
The $link parameter in watchdog() is what produces the 'Operations' column in the 'Recent log entries' page and on the page for a single log entry.
The intention is that you provide a link to the thing affected by the log item -- such as a node or a user.
Consequently, the output of this value is not run through check_plain()... which could present a security risk if a module is counting on user input in some way.
(BTW: the Drupal security team has cleared this issue to be fixed publicly.)