Seaside[1] and (IIRC) arc[2] both do this too.
My understanding was that __ViewState was intended to be encrypted in production by setting something in machine.config[3].
[1]: https://en.wikipedia.org/wiki/Seaside_(software)
[3]: https://docs.microsoft.com/en-us/previous-versions/dotnet/ar...