XSRF protection doesn't work with Members events

I have an installation with XSRF enabled, but all custom events provided by the Members extension seem to work without a token. Is this an oversight in Members, or could it be my fault?
