I'm not seeing why there's a clear line where GET cannot be authentication but POST can.

Because there isn't a line? You can require auth for any of those HTTP methods. Or not require auth for any of them.