Is CORS a substitute for authentication/authorization?

No — CORS only controls whether a BROWSER will let cross-origin JavaScript read a response; it says nothing about who is allowed to access the data. A properly secured API still needs its own authentication and authorization regardless of CORS configuration, since non-browser clients ignore CORS entirely.