> wonder if CORS world be better off opt-in rather than opt-out.

It's necessary that the defaults are secure. More so, not less, if the problem is hard.