Absolutely, there is a confusion with same-site=strict, witch effecively prevent XSS.