Per the Fetch spec,

A request has an associated mode. [...] "same-origin" [is used] to ensure requests are made to same-origin URLs. Fetch will return a network error if the request is not made to a same-origin URL.

It appears that the polyfill doesn't enforce this. I have created a test page to demonstrate this issue, and how behaviour differs between the native implementation (tested on Chrome) and the polyfill.

I believe it's possible to emulate this on top of XHR by inspecting the various origins at the right times. I'd be happy to dive into the spec and work on a PR (some time in the next few weeks) if a maintainer here signals interest in landing such a change.