Maybe? I vaguely remember webextensions not needing to do this. But I can't say that with certainty, because it might be that most websites didn't enable CORS so I never noticed, or I could just have the timeline mixed up in my head.

I don't think anything about webextensions requires this problem to exist. So if it is a problem with webextensions, it's a problem we've "chosen" to have. And browsers could fix this without drastically overhauling anything with extensions.

But I can not stress enough how much out of my depth I am commenting on this, my full knowledge is basically a couple days worth of research a year or two ago and some interaction on a bug report.