@simon I don't think CORS is real security, Mastodon has no CORS restrictions and things are going just fine. If you write a native app the CORS does nothing to prevent access.
I believe CORS was invented to prevent alternative web UIs for big apps (e.g. Gmail).