Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at {insert google ads url here}

I have setup Google Analytics 4 in Zaraz. The site is a brand new, empty WordPress site. However, since adding GA 4 via Zaraz, I am getting this error

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at {insert google ads url here}

(shortened for brevity)

And of course, GA 4 is not tracking visitors.

It seems I need to allow CORS for the {insert google ads url here}, but I’m surprised that this is not just handled by Cloudflare/Zaraz. One cannot handle setting the CORS header with Cloudflare, so I guess I need to do it on my site itself?

Why offer a GA 4 option in Zaraz if it’s not going to work by default?