Ok, this will protect old unpatched vulnerable devices. But what will prevent a negligent manufacturer that uses HTTP GET without CSFR protection to apply confi

Ok, this will protect old unpatched vulnerable devices. But what will prevent a negligent manufacturer that uses HTTP GET without CSFR protection to apply configuration to the device from just adding the CORS opt-in header everywhere? I mean it would be the simplest solution for them.