Two things to understand about CORS:
CORS enforcement is entirely client-side. The server does not validate anything.
The client is responsible for asking the web server, "who is allowed to connect to you?". The web server gives it a list (that is the
Access-Control-Allow-Origin header) of source origins the client may be "viewing" which are allowed to make requests to it.
The client (browser) checks if the origin it is serving is in the list or matches the wildcard, and if so, it allows the request, otherwise, it blocks it.
I know, generally, it sounds silly to depend on the client for security, but the thing to remember is that CORS is a spec for relaxing the same-origin policy, which is entirely a web browser concept.
Same-origin policy and CORS are meaningless outside the context of web browsers. From a pure HTTP and client/server interaction perspective, there is nothing inherently insecure about making an HTTP request to a web server. Web servers are meant to receive requests. That is their purpose. The same-origin policy is in place to prevent abuse by sandboxing web pages. CORS is a way to allow a browser to play outside of its sandbox in a controlled, safe, revokable manner. The burden is on browsers to enforce it because browsers are the ones who actually care.