An origin is not a page path
Ordinary HTTP and HTTPS origins compare scheme, host and normalized port. Different paths at the same origin do not gain script isolation, whereas a different scheme, host or nonequivalent port can change origin.
HTML also defines opaque origins whose identity cannot be reconstructed from an address string. Distinct opaque origins can serialize as null without becoming the same origin or sharing authority.
References: [1]
Same-site and cookie scope are different
Same-site comparison commonly uses scheme and registrable domain while ignoring port. Subdomains can be same-site yet cross-origin; a site-based cookie rule does not thereby allow their DOMs to be read mutually.
Cookie Domain and Path govern delivery under different rules, without full tuple-origin isolation, notably by port. A cookie path or another service port is therefore not equivalent to an origin boundary.
Cross-origin interaction has specific rules
Cross-origin interactions remain possible under specific rules; the policy is not a firewall against every network request. CORS lets a server opt into response sharing, and some requests can reach it before response sharing is allowed.
Permission to read a CORS response neither grants arbitrary access to a remote page’s DOM nor removes authentication. Resource authorization, script-readable responses and page-to-page access are separate questions.