Notably disappointing: Cross-Origin-Opener-Policy must be set on a page to isolate it as the default value is not safe. i.e., if I have a page with sensitive c

Notably disappointing: Cross-Origin-Opener-Policy must be set on a page to isolate it as the default value is not safe. i.e., if I have a page with sensitive client side data, I need to set this header to prevent a page on a different domain from opening a popup to that page then doing a Spectre-like attack on my web page and exfiltrating that sensitive client side data. I don't actually entirely understand the purpose or effect of Cross-Origin-Embedder-Policy. I thought browsers already blocked cross origin requests without CORS headers in the response that allow it. Does this header UNDO that by default?