Yes, this works, but not perfectly. Even the own EE modules and features have some problems with it. For example in the Wiki module when someone searches and is hit with this error and clicks back, he cannot search anymore, because the page is not reloaded.
Like I said, this does not work in any scenario where the user hits the back button. What is buggy about this is that EE actually recommends to do so (go back in errors). When EE shows an error caused from this protection it tells the user to go back with a link in JavaScript that is basically history back.
So the user clicks that and goes back to the page, but the form will not work anymore, because the user has to actually reload the whole page in order to get a new XID (which he does not know).
This means he will try to input a new search or a new captcha code, or anything that requires again a re-try submission and he will hit the error over and over again.
The solution is to EE in the back link to actually not only send the user back but as well reload the page automatically or generate a new XID someway.
Lets be clear, most users actually do hit the back button when something goes wrong in a form, so this is a stopper for them. It will work fine only in the first submission and if there are no errors. For some things like search or captcha, etc, this does not work.
Let me put a simple example. Someone enter 2 letters in a search field in EE, using EE search feature, the minimum is 3, so EE will show the error that it requires at least 3 letters and with an option to go back. The user will click that link or go back with this browser and then he cannot search anything anymore unless he reloads the page which nobody does. So the search then stops working.