In theory a get request sent to a server should not have any side effects and only retrieve some data. In practice implemention is completely up to the developer and their rule is about as useful as putting up an exit sign to prevent people from entering your building.

I meant read-only there in the sense of mutability, not exfiltration.

Of course, some websites may permit mutations through GET so it’s probably only sensible to use alongside known hosts.