Yes, I checked through the private network that the ai-plugin.json file and openapi.yaml are opened in the browser.
It is composed only of private networks, so you will not be able to check the contents of the file.
CORS is a a separate thing. If you have a restricted network you need to allow the IP range. ChatGPT calls plugins from their server, it’s not client-side.