1. Not all servers serve web pages. As for how big percentage of Flask users thus don’t need CSRF is hard to guess

2. WTForms is not the only way to do CSRF tokens with Flask

My point is that it’s not plausible to infer with certainty that some large part of Flask users would not have CSRF tokens just because Flask has more downloads than Flask-WTF

Just anecdata but me (and my team back then) used Flask for years, I'm pretty sure zero of our apps even had a form for users to interact with. It used to be very popular for REST APIs.