I believe the (poorly explained) rationale behind the alert is that the CSRF allows the attacker to brute force the password without triggering a captcha, as ha

I believe the (poorly explained) rationale behind the alert is that the CSRF allows the attacker to brute force the password without triggering a captcha, as happens on the main login page after a couple of bad logins. If you sent out spam containing a CSRF link that tried a dozen or so of the most common passwords, you might get a few hits, though I don't know why anyone would bother. Still, if I were Google, I would just fix it. I'm a bit surprised that Google doesn't have a generic authenticity system for all of their forms, or if they do, why it would be omitted from this one form.