If a browser does not implement CORS protections (but allows cross-origin requests), then its users must have non-standard expectations about security.