tl;dr: Zoom's recent vulnerability stemmed from a hack to bypass CORS: their localhost webserver encoded response data in image dimensions to avoid AJAX restrictions, inadvertently exposing the API to every website. A proper fix would have been setting `Access-Control-Allow-Origin: https://zoom.us` on the localhost server. The author argues this reflects a broader pattern of developers misunderstanding CORS and working around it insecurely rather than configuring it correctly.