I'm unhappy at the prospect of passing sensitive data like contact details as URI parameters for a POST (where they will show in logs, etc.). Is it possible to pass the details in the content body instead? This is standard practice for RESTful APIs and I'm surprised that it is not the standard for civi.
Yes the civicrm extern/rest.php will merge GET and POST parameters.
Regarding security, while yes it is better to send private data in POST, it's not necessarily that much more secure since POST data can be logged too, just you're right not usually by default. See also https://security.stackexchange.com/questions/30754/is-there-a-difference-between-get-and-post-for-web-application-security. For real privacy it would need to be encrypted, and then have some way to decrypt it at the civicrm end.