Sure, but this was the presence of a bug. In a web framework you can easily have a test that fails when CSRF vulnerabilities are present. It's not some zeroday that has just been published, CSRF has been known for a very long time now.

As a demo, here is a link to an 1100 line file full of such tests for the Rails framework: https://github.com/rails/rails/blob/main/actionpack/test/con...