In order to be able to do cross-domain AJAX requests, SharePoint 2013 introduced SP.RequestExecutor.js library which uses a hidden
iframe to do the request.
This looks hacky (although I'm not sure if it actually is) and is different from the developers who never used SharePoint before are accustomed to.
Why not using the standard way which relies on CORS (which is actually the recommended standard of the W3C)?
Since the cross-domain requests are done between applications handled by SharePoint, it seems natural to provide and use CORS under the hood, transparently (allowing to configure
Access-Control-Allow-Origin header within SharePoint 2013 Central Administration).