Simple, if you have an iframe pointing to http://foo.test/deletesite.php, without cors that request will be done, with cookies and everything, without the user being aware of it.
AFAIKR you don't need CORS for framing, or making cross origin GET or POST. You only need it to read the response of a cross origin request and setting certain request header and body etc.
For example you can make a cross origin GET with an img tag, and a cross-origin POST with a form tag and some JavaScript.
That attack you mention is a CSRF attack. CORS doesn't really protect against that. That exact attack you mention is possible if foo.test doesn't implement CSRF protection. CORS doesn't automatically provide CSRF protection.
