According to the page the HTTP CORS headers prevent JS execution. But the problem remains that svg can embed and execute JS on servers without these non-default headers.
CORS is for allowing other origins to read resources (and send special requests/special headers). It's not really relevant here.