Why?
Because only web browsers care about CORS. Curl/wget/Invoke-WebRequest/postman/python Requests/etc are blissfully unaware, they neither know nor care about CORS.