did you find solution?

I dont understand similar thing. I create and pass token to template.

Each refresh will regenerate token:

$expectedToken = $csrfTokenManager->getToken('_mysecret_csrf_token')->getValue(); //bba0920c884cf93c0bdaa8fbf.-EEwG_RGb1YwNQuxeaYCDDboDth3CbvTsdZT1wHTA3Y.1StTarsqCBJbTXjfNfNkRm68aIk0MIzq25ACg3mGbh6pMXh4nyE9AURnSg

Then in template I manually update this token to "123" and submit

if($request->isMethod(Request::METHOD_POST)) {
            $submittedToken = $request->getPayload()->get('token'); // NOTICE 123 123bba0920c884cf93c0bdaa8fbf.-EEwG_RGb1YwNQuxeaYCDDboDth3CbvTsdZT1wHTA3Y.1StTarsqCBJbTXjfNfNkRm68aIk0MIzq25ACg3mGbh6pMXh4nyE9AURnSg
            if ($this->isCsrfTokenValid('_mysecret_csrf_token', $submittedToken)) {
                
                echo 'ok';
            } else {
                echo 'Invalid CSRF token.';
            }

it will print ok however I added "123" to submitted token but when I change submitted token to something totally different like "Hi Peter" then it will print Invalid CSRF token I thought those generated and submitted tokens HAVE to MATCH EXACTLY and not partially