That hidden CSRF field can be added without form_with though, and Rails still protects against not including it. I left it out of the example as it didn't seem relevant
Note: I totally agree that we should strive to go HTML first. However, this specific example is a bit unfair.