CORS only works on browsers. From nitter FAQ "All requests go through the backend, client never talks to Twitter"

So they are proxying the calls to Twitter servers.