ACAO is security-by-stupidity, to be honest with you. You have to *trust* the client to obey the ACAO directives to not access things they aren't supposed to, which you can't do because older browsers and anyone with curl/wget can bypass them anyways and hand-craft malicious requests.

Your server security needs to be enforced on the server-side, not the client-side, so this ACAO configuration is just to placate Firefox (the ones that started this nonsense). You're no less secure with ACAO: "*" than with restricting the ACAO value, but just making things more difficult on yourself and possibly your own users if you forgot to include a subdomain in the ACAO listing and missed it during testing, which makes it the same kind of "security" as DRM.