Labs, or at least Tools Labs, should be added to the CORS list. That would allow, amongst other things, for the retrieval of cached Wikidata objects, like this:
This would reduce the load on the servers, and speed up the access to Wikidata objects (unless done in huge numbers).
I would prefer CORS to be enabled for all of the Wikimediaverse, not just the Wikidata URL(s), for a few other tools.
According to bug T62835 Labs should be added to $wgCrossSiteAJAXdomains, apparently.