I have a questions concerning methods for executing CSRF. I did the CSRF Prompt By-pass lesson in WebGoat (Lessons -> Cross-site Scripting -> CSRF Prompt By-pass). The lesson requires you to craft an email message that sends two malicious requests to a web app the that the recipient is logged in to. The first request sets a money transfer amount. The second is a confirmation request sent when the user would click "confirm" on a confirmation page.
I solved the task using JavaScript code that sends the requests as HTTP Post requests. I suppose another option would be using forms and JavaScript to submit the forms automatically.
My question is why do most people seem to solve the lesson using img tags or iframes with src set to the target URL with the necessary parameters? I'd expect a money transfer to be done using HTTP POST requests, not GET. Is there an aspect that would make using JavaScript code or forms an invalid or problematic method for CSRF? Is there a practical difference when compared to the aforementioned tasks? I believe authorization isn't it because you can have cookies sent JavaScript fetch and when submitting a form.