Is bypassing Drupal's #token protection against CSRF safe for search forms specifically?
I think the biggest question when judging a potential CSRF problem is whether some form of damage will be done if a user is tricked into taking the action. If there is a CSRF vulnerability that deletes a user or unpublishes a node, that would be a problem. But being tricked into executing a search is only potentially a problem in terms of the resources a search takes to execute (which is not that much). Even if the core search doesn't bypass the token, it is accessible as a GET url (search/node/keyword) so someone could be tricked into visiting that URL bypassing the form in front.

Another way to think about it is whether the action is idempotent. A search is an idempotent action (by the W3 definition, log records might be created, but that's not a big deal), so it doesn't need CSRF protection.