The covid certificate site, puts its csrf tokens, nonces etc in it's urls. Isn't this inherently insecure?

OWASP says any change of state transactions shouldn't have csrf in the url. 

This URL is for signing up to the certificate site.   The previous screen disclosed nonces etc in the clear.

I've sent a contact and asked them but had no response.