Why is CORS not the same thing as API security or authorization?

In production I maintain an explicit origin allowlist per environment and never combine credentialed access with a wildcard origin. Preflight and actual responses are tested through the real proxy or CDN path, including custom headers, cookies, preview domains, and denied origins. Responses that vary by Origin carry cache behavior that prevents one origin's permission from being reused for another. Logs make policy failures diagnosable, but authentication, authorization, CSRF defenses, validation, and abuse controls remain mandatory regardless of the CORS result.