There's probably a reason it's so unprotected (though probably not a very valid reason).

Writing CSRF-safe logout would mean that you can't have an href to a static link, and you'd to implement some sort of unique id/key and/or a form post behind the scenes.