CORS is a policy provided by the server, which is then enforced in the browser. A permissive CORS policy allows a fetch request (i.e. Javascript based XHR etc) to request data cross-site and make used of the returned value in the application. Without CORS such activity would be restricted by the Same Origin Policy.
With a man in the middle attack like Burp one can intercept, read and maybe modify the communication. With such an attack any request could be modified so that the expected answer can be retrieved and read. There is no bypass of CORS needed since the man in the middle attacker does not adhere to the CORS policy anyway. This means considering such man in the middle attacks from the perspective of CORS is irrelevant and these are thus out of scope.
But a browser by its own does not allow to modify the Origin header or to add another one. This way it would not be feasible to add another Origin header without some man in the middle attack. This means the attack envisioned is not possible in practice, it is only possible using some out of scope man in the middle attack.
