> CORS rules only prevent the JavaScript web client from reading the response from a remote endpoint

Assuming the web client plays nicely. I commonly bypass CORS for playwright unit/E2E testing.