You say that, but there are lots of security features like SameSite=Lax that are built on the assumption that GET requests are harmless.