I've always wondered if part of the root issue is that Same-Origin Policy, and CORS by extension, were not very intuitively designed abstractions/APIs to begin with.