> Second, in many environments (managed hosting etc.) there is not an easy way (or indeed a way at all) of adding headers to responses.

It's getting better. Most serverless hosts (including Cloudflare, which this site uses) follow the (req: Request) => Response pattern, which by definition allows sending headers.