> CORS doesn't block the underlying GET/POST request

It does block ALL requests for certain content types.

In the common cross origin case of a JSON API, CSRF beyond CORS is unnecessary.