ping @bschussek

What about

<?php
// CollectionType.php
        if ($options['allow_add'] && $options['prototype']) {
            $prototype = $builder->create($options['prototype_name'], $options['type'], array_replace(
                array('label' => $options['prototype_name'] . 'label__'),
                $options['options'],
                array('csrf_protection' => false)
            ));
            $builder->setAttribute('prototype', $prototype->getForm());
        }

Yes, that was first what I thought about, but the form extensions should be decoupled I think, Core doesn't know about Csrf.
If someone doesn't use the Csrf extension, this could trigger an exception about non existing option, not checked that though.

It could be moved to the default options of a collection type extension. Not sure what is the best way to fix this.

This is basically the implementation that was used before csrf refactoring, it is a bit tricky, because we're adding it and then removing. I think we could somehow identify whether the field is prototype or not, but current approach is more universal.
It will work also with dynamically added forms on form data events.

I fixed this in a separate PR. The fix was a bit different.