I'm wondering about the security implications of this default referrer setting to "Spoof referer (send the same url)" (step "Privacy", third item from the top).

I'm wondering about the security implications of this default referrer setting to "Spoof referer (send the same url)" (step "Privacy", third item from the top). Wouldn't that then bypass all csrf checks, where the site checks if the referer is correct, because your browser is overriding and always setting it to the expected origin?