Not really. In lots of relatively large companies there is a good relationship between infrastructure, development and security teams and they will work to find a solution that works for everybody.
CORS is allowed while running locally and then set while running in development and finally production.