1.) Turns out this is no longer true because the cors issue is fixed as of two weeks ago.

But to answer your question:

Well that's the really silly part about it. You see, the way CORS works is that it only works if the client making the request implements cors. In this case when I say client I'm talking about your web browser itself. Native applications, or hitting an API directly via network calls, don't implement cors and thus you can make the calls all you want and the server responds. So even when cors was configured to only allow requests from the correct domain it only affected people with web browsers.

However two weeks ago a PR was merged into the Lemmy source code setting the cors to by default allow requests from anyone instead of a specific domain.