CSRF relies on the browser sending the cookie with a cross-site request automatically,  since Javascript/attacker's site don't have access to the cookie.

CSRF protection relies on the server correlating something the browser sends automatically (the cookie) with something in the form (the token).

A non-browser client will be in control of both the token and the cookie so can make them match (if it can get the cookie at all).

TL/DR - CSRF is inherently a browser attack, so protections against it are only required when talking to a browser.