There's module in Rules Bonus Pack that allows you to configure a Panels variant that triggers a Rule execution. This is an easy way for site builders to create CSRF vulnerable configuration.

Perhaps the module documentation, or help text in the module should highlight the security issues around configuring GET requests that effect a state change?

There is an alternative module called Rules Link that creates properly tokenized links to trigger Rules, so perhaps this should be recommended as an alternative module for links that perform actions as a result of triggered Rules?