Essentially, if an IP of a server is discovered, packets can be sent to it and bypass any restrictions set by scripts in game. To prevent this, many people create tokens and verify the token is set before it carries out actions of the request.
Trello has done this with their keys, but these are easily discovered and can be used to gain unauthorized access. The same issue is with any loaders that have keys to talk to their own servers.
To find a key in a loader, all one needs to do is start the server in studio, see what is loaded, and then grab the key. Therefore CSRF is possible.
Does Roblox provide a way to secure a key to prevent CSRF?