I think you're trying to ask why servers have origin checks when it comes to protecting resources and sensitive actions. CORS will prevent the reading of sensitive data by malicious sites, but it will not prevent the posting of data to a server. An important step in added security to mitigate this is the now default same-site policy on cookies across all major browsers. However, security needs redundancies (what if same-site policy is set to lax accident?) and additional server checks are important.
For example, your bank would like to protect your account. If a malicious site tries to call your bank site requesting a withdrawal, the bank server should first check if the Origin header of the request matches the bank's domain (or aby of its whitelisted sites). If not, it should reject the request. Hidden form tokens provide another layer of protection against cross-origin writes. A rest client or curl call can spoof the origin as some comments note, but that doesn't matter because an attacker still needs access to the cookie key which resides in your browser. Back to the browser, CORS policy alone won't secure the server from processing a request as you can see.