Why is CSRF protection typically unnecessary for stateless JWT-based APIs?

CSRF relies on the browser automatically attaching a cookie the attacker's page can't read or control. A JWT sent via a custom Authorization: Bearer header isn't automatically attached by the browser to cross-site requests — the malicious page has no mechanism to make the victim's browser include that header, so there's no forgeable request to protect against, PROVIDED the token isn't ALSO stored in a cookie that gets sent automatically.