Why doesn't Spring Security's default CSRF protection cover GET requests?

HTTP semantics define GET as a safe, idempotent method that should not have side effects — CSRF protection targets state-changing operations (POST/PUT/DELETE/PATCH). If an application incorrectly implements a destructive operation behind a GET request, that design itself is the vulnerability (also making it trivially exploitable via a simple <img src=...> tag, no form needed), and no amount of CSRF token configuration fixes a fundamentally unsafe use of GET.