“It’s hard because it’s part of how browsers fetch stuff, and that’s a set of behaviours that started with the very first web browser over thirty years ago.”
Browsers let any site embed images from any other site for 30 years without asking. CORS is the patch for everything that came after. Most developers fix CORS errors by pasting a wildcard header until the red text goes away. That isn’t winning. That is turning the security off.