Questions about csrf protection

I do net set the csrf filter to GET, the first example was only to show what happens if I define the $methods array. My normal setting is the second one, with $methods = []. I do not however understand, why, even in the case where I do not explicitly set $method=['GET'} the csrf filter is applied to GET as shown in the second output...
My ajax calls are always POST.