passing POST payload in Content Body
Yes the civicrm extern/rest.php will merge GET and POST parameters.

Regarding security, while yes it is better to send private data in POST, it's not necessarily that much more secure since POST data can be logged too, just you're right not usually by default. See also https://security.stackexchange.com/questions/30754/is-there-a-difference-between-get-and-post-for-web-application-security. For real privacy it would need to be encrypted, and then have some way to decrypt it at the civicrm end.