So you can deploy a bazillion devices without each one needing internet access, which typically has a cost because there's administrative overhead to handling abuse complaints, etc, that come along with full internet access.

If all you got was a one-way stream of data with no internet access (assume your CORS virtual station location is the AP's location, so no need to even pick your own mountpoint) then the abuse potential is basically nil. Just like with FM RDS and stuff, it's just a broadcast that you receive, you can't do anything bad with it. It's not internet, it's just one-way data. Difference being that a lot of microcontrollers now have wifi MAC/PHY built in, whereas FM would need more silicon.