Comment by webdever

subdomains are not always the same origin. See "public suffix list". For an example think of abc.github.io vs def.github.io

I didn't get the part at the end about trusting browsers. As a website owner you can't rely on browers as hackers don't have to use a browser to send requests and read responses