It looks like it intentionally didn't have any protections in place. The edit page has the comment <!-- Feel free to take advantage of the lack of CSRF protection -->

It also has <h1>What could possibly go wrong.</h1> go wrong in the default editor source.

Was it irresponsible? Yes zq should have put a warning for sure. Still a cool experiment. Twitch Plays Pokemon with bigger repercussions.