Per dotnet/AspNetCore.Docs#31205 (comment) ...

This prevents the endpoint from accepting any forms posts. I spoke with our security team, and they indicated JSON-only endpoints that don't accept form auth or form posts don't need XSRF protections (which is why the MapIdentityEndpoints don't use anti-XSRF). The only way the /logout endpoint above works is if you post a JSON payload of {} which becomes an empty object with no properties but is not null. AFAIK this can't be done from a form.