They are safe because of the Same-Origin Policy: an origin A (site.com) cannot read a resource from another origin (other.fr) unless you've whitelisted that using Access-Control-Allow-Origin.
In case of basic CSRF, the attack does not consist in reading the response, but it consists in tricking the server to do an action that was fired by a victim user without this victim being aware of it.
So in basic CSRF, the victim has a token that attacker cannot know (Same-Origin policy prevents it). When victim requests something from the server (
/user/delete?id=15 but in real world, do not pass the ID by
GET but by
POST since it's changing server's state), then the server will check if that token is present and valid. If not (because it's fired by the attacker, which cannot know the token) then the server refuses to process it and the user 15 is not deleted. When token is here and valid, the server deletes the user and returns the response (that one can still not be read by attacker).
So Same-Origin prevents attacker from reading the response, while CSRF token prevents the server from processing an unwilled request.