I was expecting a rant, but, wow, it was far better than that. This is a well founded criticism.

CORS is an afterthought that never carefully integrated into the ecosystem, which resulted in bad DX. It’s so blunt that applying CORS always feels like a hack.