Why is there no "access-control-allow-origin" in the header?

Question

CORS

I read about such a thing as "CORS"
I decided to check it in practice, but something does not converge ...
So I upload 2 pictures from different sites to my page, that is, it turns out I'm trying to request data to my page from another source?
But in the header of one picture there is an access-control-allow-origin: * field , and in the other picture in the header there is no such field at all, but it is not blocked by CORS. Or have I misunderstood something?

Answer 1

CORS affects the work in scripts, files can be connected in their tag any.
For example, you can put the first loaded image in the script into canvas and parse it into pixels, but security will not allow you to do this with the second one.