> How can someone even programatically inject referral links in your page

that is not what happened.

on my google keyboard, "fuck" autocompletes to "duck" but I'm not claiming any grand conspiracy unless it was a duckduckgo keyboard.