Action API requests with centralauthtoken=… do not produce CORS headers if the token is invalid. Much like in T420280, this prevents client-side JavaScript code from handling the error.
The fact that no one complained about it in 12 years probably means that such errors almost never happen in practice, and we can freely change the response format.
To reproduce, visit e.g. https://www.mediawiki.org/ and run this in browser console:
CoreForeignApi = mw.ForeignApi.parent; await new CoreForeignApi( 'https://test.wikipedia.org/w/api.php', { anonymous: true } ).get( {} ); // succeeds await new CoreForeignApi( 'https://test.wikipedia.org/w/api.php', { anonymous: true } ).get( { centralauthtoken: 'asdf' } ); // fails with console errors about CORS; should fail with 'badtoken' or something like that