GET requests can have bodies too, and many low-level APIs will allow it - given how few things seem to be aware of this, you could probably sneak stuff through that way too.
A query parameter on a GET request is actually data written to memory. So this idea that any HTTP verb somehow provides context or enforcement of read versus write totally misses the point.