Why doesn’t a form need an ‘action’ with a plugin that uses the post data?

By default no action url will mean that the form will be sent to the URL the page was loaded from. Once it is done, the code evaluating the shortcode is checking in the form was submitted and process it.

This is not not a great way to write a from processing code, as the evaluation of shortcodes happens too late for doing something like redirect on success.

Leaving the action empty is not horrible by itself but you should try to be as explicit as possible whenever you can.