I think the concern is for even clicking a link, which to my knowledge typically hasn't fallen under implicit CORS concerns. The browser will automatically assume that unless a private origin server (i.e. one within a private address space) explicitly allows requests from a public source, then the navigation should be prevented.
It's always a challenge in browser design, but basically this is just another case of killing valid use cases because some servers don't follow the spec (i.e. GETs with side effects).
It's always a challenge in browser design, but basically this is just another case of killing valid use cases because some servers don't follow the spec (i.e. GETs with side effects).