The change which made this noticeable was most likely DEV: Modernise highlightjs loading (#24197) · discourse/discourse@0878dde · GitHub, which switched highlightjs to load via native import(), which requires CORS headers when fetching from a CDN.
But even before that change, you likely would have had some issues with things like custom Fonts (which also require CORS headers for cross-origin requests).
In theory, Discourse itself should be adding the CORS header to CDN responses. If it’s not, that probably means your CDN is not setting the CDN hostname (i.e. not the forum hostname) in the Host header or the X-Forwarded-Host header.
That said, adding the headers via the CDN config likely achieves the same thing 