Yes and if I were a hacker, I could do the same thing with curl. Either way the only person who's likely to do it is someone who is technically savvy.

You can do the same thing with POST by submitting a form with JS. The correct way to protect against this sort of thing is to use a CSRF token.

Submitting a form with JS is a whole other level of complexity than just having a link out there in the wild that performs write operations. And using a CSRF defeats that stated intent.