CORS is only to prevent cross-origin reading inside the browser.
But what does this mean for applications outside the browser: Since these are not expected to be used as an attack vector for cross-site reading in the first place they are irrelevant in the context of CORS. Of course, if such an application actually implements browser-like behavior and actually supports authenticated cross-site requests then it should also implement the relevant protections browsers have, i.e. Same-Origin-Policy and CORS.
Note that CORS is not a replacement for authentication. A server still has to implement proper authentication to restrict what kind of data the users can retrieve. But with CORS a cross-site requests can be made which uses the existing authentication to retrieve protected content cross-site - but only if allowed by the CORS policy.