Why a crawler would send anything but GET
Illyes gave the reason in one word: JavaScript. Google renders pages, and rendering means running the page's scripts. A script that calls another origin triggers a CORS preflight, and a preflight is an OPTIONS request. A script that talks to an API can issue PUT, PATCH or DELETE the same way any browser would.
HEAD is the plainest of the five. It asks for a response's headers without the body, which is how you check whether something exists or has changed without paying for the download. Illyes did not break the 1.5% down by method, so there is no way to say which of the five carries most of it.
What to do about it
Check what your firewall does with non-GET methods
Method filtering usually lives in a WAF rule or a server config rather than robots.txt, which means it is invisible to the crawl reports you normally read. If PUT, PATCH and DELETE are refused at the edge, verified Googlebot traffic is now inside that rule. How much it costs you depends on how much of your storefront depends on client-side rendering: a category page that ships its products in the HTML loses nothing, and a page that fetches its grid after load has more at stake.