Is a SameSite=Strict cookie sent if VICTIM.COM does a redirect?
If so, it sounds like the next trick to follow would be a type of "redirect gadget" to get SameSite=Strict to be exploitable again. If so, maybe it's only the end of CSRFs without a gadget.
Eg of "redirect gadget", CSRF via VICTIM.COM/open-redirect?url=/update-password...