This is simply because it has always been allowed. Even before JavaScript, a form could post to an arbitrary URL. So to remain backwards compatible, CORS could

This is simply because it has always been allowed. Even before JavaScript, a form could post to an arbitrary URL. So to remain backwards compatible, CORS could not disallow it.