But yes in general making actions happen in response to a GET request is generally a bad idea, since these are often cached and considered "safe" to retry.
Logout (or anything else that triggers changes of any kind) shouldn't be a GET request.
For a large IDP like Google, Facebook, Microsoft, etc, you start to want* logout via cross-site requests, but it needs to be protected against DoS attacks like the link provided. So you need some other proof that the requesting site has a session - a session ID, an ID token, a unique identifier for one of the users in session (this is the least bulletproof one).
* well, standards wise at least. Google doesn't document a logout url anymore.
EDIT: Nonces are better, ignore this reply.
Currently, you can also get a similar protection by requiring headers such as "Content-Type: application/json", since other sites will not be able to make that request.
Referer does work in some cases, but it is fairly common for users to disable the Referer, so relying on it for site functionality is not ideal.
Thinking about it, you could probably use CORS and some methods like X-Frame-Options to protect your nonce. But then you could just use that on the whole deletion page and avoid the nonce, I guess?