It is plausible, but I do have scripting & images shut off in my email client, use NoScript in the browser to prevent unknown scripts from executing (where I do sometimes read Gmail), and saw no such link. If Google is executing them on the server side, I've lost control.

The other indication against this is that this only appeared at the same time as the auto-populate for flights appeared, and never after I turned off that service. Yet, I've received many flight confirmations from the same airline.

So, it would have had to have been a short-lived shady link deal between the hotel & airline at exactly the time that Google started auto-populating the flights, then dropped. Possible, and important to consider, but...