Your premise is wrong.  Script tags and JSON don't bypass the same-origin policy.

The same-origin policy says that `evil.com` should not be able to read the responses for arbitrary resources on `victim.com`.  Note that Javascript from `evil.com` can trigger arbitrary requests to be sent to `victim.com` (e.g., by creating an IFRAME pointing to `http://victim.com/whatever.html`).  However, the Javascript from `evil.com` cannot read the contents of that document: i.e., it cannot read the response to that request.

Now perhaps what you are thinking of is that `evil.com` can ask the browser to load arbitrary code from anywhere on `victim.com` and execute it, with all of `evil.com`'s permissions.  That's not a bypass of the same-origin policy.  (Note also that it tends to be a security risk, for the party who is loading Javascript from third-party sites.)

XHRs have to be restricted, because XHR allows Javascript to not only trigger a request to be sent, but also allows Javascript to read the response.  The same-origin policy forbids that, for cross-origin requests.  The same-origin policy says that reading the response is something that should only be allowed if the request is to the same origin as the origin of the Javascript code.  Thus, Javascript from `evil.com` is allowed to issue a XHR to `http://evil.com/doit` and read the response, but it is not allowed to issue a XHR to `http://victim.com/doit` and read the response.

If you want to issue cross-origin XHRs, then the target domain will need to authorize you to send it cross-origin XHRs.  Look into [CORS](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) for ways to do that.