I think you are misunderstanding where and why CORS is used. It is not intended to prevent a script from calling out to an untrusted server (with an
Access-Control-Allow-Origin: * header, for example), since that is often a valid use case. The default, restrictive policy doesn't even restrict whether data can be sent; even without that header from the server, a client can send arbitrary data that will be received by the server.
Here's an example where the default policy is helpful:
In either scenario, the attacker can't read any cross origin data since the target websites do not bear the necessary header to relax the policy. The attacker does not control these headers, as they do not have access to the systems in question.
Furthermore, by using my own server as a proxy, and spoofing headers,
I can essentially make any HTTP call to any server in the world,
regardless of their CORS settings
Maybe, but what does this gain you? You can't accomplish either of the two scenarios I provided above, especially since credentials won't be sent to the wrong domain.