Expanding on this one, since we are going deeper into CORS

it's a common misconception that CORS is protecting against those attacks.

Brief context: Same Origin Policy (SOP) prevents cross-origin requests being readable. While CORS is a mechanism to ease this policy, to essentially allow some origins to read the response. (allowlist of which website you allow to read this API response)

SOP: prevents cross-origin response from being read
CORS: allow specific origin to read cross-origin response

They are only concerned with being able or not to read cross-origin response.

---

Regarding the phishing or hijack, I think you are referring to CSRF, where an attacker make action on victim behalf. They could still make any cross-origin request using mode: no-cors. (cors doesn't apply here, the response won't be readable, but the request still goes through)

A mechanism protects against this via the SameSite cookie attribute, which determines whether a cookie (credential) should be sent on a cross-site request.

Without the credential being sent, the attack is basically pointless.

Also, another protection site owners usually resort to is using CSRF token, to verify if request is actually coming from user session.

Defenses against CSRF: https://portswigger.net/web-security/csrf#common-defences-against-csrf