For the privacy of the user, nowadays the referer header are either shortened or voided by the browser. You reintroducing the string by a side-channel could be seen by users as a backstab, even if you see it as "etiquette".
I tried entering ?utm_source=foo on Chris's site when it was posted the other day, and was surprised it didn't trigger the page. Pretty sure one or more of my firefox extensions remove that specific one from URLs before making the request.
Facebook combining tracking and IDs into an opaque UUID in URLs so they can't be removed is a level of user hostility beyond this.
Now I have the stupid contrary idea, require a specific query string parameter to be present…
For me, it comes from uBlock Origin’s AdGuard/uBO – URL Tracking Protection list, which removes almost three hundred parameters unconditionally and a lot more conditionally: https://github.com/uBlockOrigin/uAssets/blob/master/filters/...
(A few of the parameters in that list are a little alarming in a you-could-easily-name-a-legitimate-parameter-this sort of way, like user_email_address, maf and taid.)