I remember that JSF(java faces) used the same __VIEWSTATE approach to preserve the state, attaching the state to every request. It may also be a great source of security vulnerabilities.

Luckily neither .net WebForms, nor JSF are popular nowadays.