It's a possibility, but it's not how these kernel panic viewer websites are currently implemented. They do the decoding on the clientside, with the data stored in the URL fragment, which is not sent to the server by default.
Still good to have alternative implementations, though. The Javascript could be silently stealing the URL fragment on only specific requests, so there's no real way to audit it to be sure.
That’s how link previews work on iOS (it was the cause of the zero click RCE a few years ago by executing row hammer through WebView), so I guess it depends on your software.
