This isn't to defend against a malicious user crafting requests, it's to defend against a malicious site tricking the user's browser into making an authenticate

This isn't to defend against a malicious user crafting requests, it's to defend against a malicious site tricking the user's browser into making an authenticated request. Said malicious site can't set those headers. Edit: I think I misread your comment and you're not arguing that checking origin/referrer isn't enough for security, but rather that it will block legitimate, privacy-conscious users. Using a CSRF token is a valid alternative, and it's mentioned just below in the article.