Unless I'm missing something, the post is plain wrong in some parts. You can't POST to a Cross-Site API because the browser will send a CORS preflight first before sending the real request. The only way around that are iirc form submits, for that you need csrf protection.
Also the CORS proxy statement is wrong if I don't misunderstand their point. They don't break security because they are obviously not the cookie domain. They're the proxy domain so the browser will never send cookies to it.
Anyways, don't trust the post or me. Just read https://owasp.org/ for web security advice.
Not sure how Japanese law has anything to do with this. I'm pretty sure under US law (the one that ultimately matters for streaming) leaves all the rights of recorded videos of the game with the right holders of the game. That you're allow to record/stream games at all has no legal precedent, it's just a wise business decision by publisher to not forbid it (anymore).
And legality aside. As a dev I wouldn't want racist or bigoted streamers to show my game and make money off of my work. Same with leakers. Sure for a big company I don't care but if someone leaked an indie devs work, we would consider it a dick move as well.