great find and thanks so much for sharing it with us! Netlify’s tech support would have given you a very similar answer 
If you’re using _headers that would look like this instead:
/*
Access-Control-Allow-Origin: *
and the main gotcha is that that needs to be sitting next to index.html after your build completes, rather than in the root of your repo like netlify.toml