Why do they get into the cache without Access-Control-Allow-Origin?

Question

symfony

Symphony's Api uses the nelmio_cors bundle - it puts headers in accordance with 'Origin', but requests without Access-Control-Allow-Origin in the response somehow got there, which causes a CORS error in the browser.

vary: ['Accept', 'Content-Type', 'Origin']

'Accept' added just in case. I can't understand how this happens. It is an accident? Am I missing something? There is a possibility that for some time there was no 'Origin' in vary - but after that the cache was cleared.