It is widely assumed by users that web browsing is safe.

If a browser does not implement CORS protections (but allows cross-origin requests), then its users must have non-standard expectations about security.