URLs in goal descriptions are automatically turned into links, but these links don’t have rel="nofollow". On the other hand, the “your site” URL linked on a user’s gallery page is nofollowed, which seems to indicate that nofollowing is desired for these user-provided URLs.
Actually, when looking at the changelog, I find UVI 2033 from back in 2016, which seems to indicate that (at least at the time) nofollow would only be applied to the links of non-premium users. This in theory might be throwing off my above analysis of what is and what isn’t nofollowed, but it actually seems to no longer be correct, with even premium users’ personal links being nofollowed.
I suggest a consistent approach, whatever it may be, between URLs in goal descriptions and personal URLs on user pages. That consistent approuch could be nofollowing them all, nofollowing them only for non-premium users, or even getting rid of nofollow entirely, betting that what with the commitwall, the risk might not be that bad.