Because the WAF block page doesn't have CORS headers - you can add them on a Transform Rule if you scope it to when

cf.response.error_type

is equal to `ratelimit`: