Quoting @dawehner at #2614466-1: No ability to stop a specific block from caching through the UI:
So yeah views has a bug that it doesn't apply the cachability metadata of the tokens upon the rendering
\Drupal\views\Plugin\views\PluginBase::globalTokenReplacehas a bug.