_csrf_token in simple_form: live_render yes, live route no

Using the same template containing:

<.simple_form :let={f} phx-change="handle_stuff">

When implemented using:

scope "/", MyappWeb do
  live "/stuff/:x/:y", StuffLive

Generates a form without:

<input name="_csrf_token" type="hidden" ...

While implementing the same template containing the same form using:

live_render @conn, MyappWeb.StuffLive

does generate a csrf-input inside the form:

<input name="_csrf_token" type="hidden" ...

Why does the live route behave differently?

Because StuffController assigns @action while StuffLive does not.