[xg15]

Yes, but if ads do it, that would at worst make the ad server vulnerable, not your server.

[Beltiras]

You apparently understand less than me. The little I do understand is that CORS is protection for a site's user, not the site.

[TeMPOraL]

It's a protection of site's business model.