I understand CSRF and why cross-domain AJAX requests with cookies or other credentials can't be permitted without an
Access-Control-Allow-Credentials header explicitly permitting them - otherwise I'd be able to do things like lure people to a site that hijacks their Facebook cookies to post something on Facebook in their name.
What I don't understand is why even uncredentialed cross-domain AJAX requests are not permitted without an
Access-Control-Allow-Origin header. With no credentials involved, CSRF seems impossible and so the only arguments that I know about for the Same Origin Policy seem not to apply. What vulnerability would sites or users be exposed to if this restriction were not in place?