If you are using an up to date version of Firefox, Edge or Chrome it defaults to Lax. The exceptions are Safari, IE and Safari for IOS. I don't think this is worth a 8.1 CVSS.

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

There is certainly less need for it now as browsers have many more mitigations in place than when CSRf was first introduced.

But I would say yes you still need it for defence in depth.

For instance in RFC6749 (OAuth 2.0) it says clients MUST implement CSRF for the redirection step.