csrf_meta_tag is basically fulfilling the same thing as hidden form fields but is there to give javascript requests that aren’t tied to a form an easy way of getting the token.
If you use the jquery-ujs library the content of that meta tag is automatically added (as a request header) to any ajax requests made.