A question worth pondering is if this is something that should continue to be fixed at the site level, or whether it's representative of an overarching problem

A question worth pondering is if this is something that should continue to be fixed at the site level, or whether it's representative of an overarching problem with the data that browsers make available around cross-origin requests. access-control-allow-origin was supposed to be the means of addressing cross-origin concerns, but in this case even its usage doesn't prevent the issue. Perhaps browsers need to expand the potential effects of access-control-allow-origin.