You get work around it using a CORS proxy COVID-19 Netherlands Reproduction Number Tutorial / Tom Larkworthy / Observable
The issue is you have to manually allow-list API access to browsers through headers. If they do not do that the browser will not connect. So either 1. they add the headers, or 2. you access the data through a proxy that does have the right headers