Later it was decided that this policy was too restrictive, and thus the Cross-Origin Resource Sharing (CORS) standard was created. Once again, this standard had to be backwards-compatible with existing servers, and those servers still didn't check the
Origin header. Why would they? Browsers already prevented cross-origin access to site data automatically; there was no need for a separate check. Therefore, CORS had to require sites to explicitly opt-in to cross-origin access to a specific page. Requiring an opt-out (via rejecting the request if the
Origin header is wrong) would, again, break the security of existing sites. Thus, the
Access-Control-Allow-Origin header was born.
Even aside from backwards-compatibility though, there's still a significant benefit to not requiring servers to check the
Origin header. Making cross-origin access require an opt-in ensures that developers and web servers don't accidentally compromise their own security by failing to properly validate the
Origin header. It's secure-by-default rather than "insecure unless you make sure this particular header is set to the right value".