> Since it’s common for subdomains to host other applications that may have their own security concerns, ditching CSRF tokens for Lax cookies may not be a wise step!

This is a really fantastic point, and it applies to CORS as well.

It's common to ditch CSRF tokens when CORS is configured, which is perfectly legitimate. But reflecting the Origin in Access-Control-Allow-Origin is dangerous if you have subdomains hosted by a third party AND are using `credentials: "include"`.