How do userscript managers bypass the same-origin policy and allow for cross origin xmlhttprequests?

Question

Userscript managers such as Tampermonkey and Greasemonkey have a built in API called GM_xmlhttpRequest which allows userscripts to retrieve data from other sour