Not every TCP server speaks CSRF. This isn't about 'garbage software'; it's about the expectation that a local LAN is not exposed to the Internet and therefore

Not every TCP server speaks CSRF. This isn't about 'garbage software'; it's about the expectation that a local LAN is not exposed to the Internet and therefore does not need the same security controls that an Internet-facing network does. Browsers making requests on the LAN breaks this expectation. Before someone says "but I don't expect that", well, why do you even have a firewall? With the notable exception of Google/BeyondCorp, practically every LAN in the world expects to trust its members. Having untrusted code in browsers able to send requests on the LAN violates that expectation.