It's the right tool for preventing WEBSITES from using your endpoints - they might be able to take your JS, reverse engineer and run it, but you can mitigate ho

It's the right tool for preventing WEBSITES from using your endpoints - they might be able to take your JS, reverse engineer and run it, but you can mitigate how useful this is by preventing calls to CORS-protected resources. This does not protect your endpoints from attackers in general though, so to your point, it depends what they're trying to accomplish.