How does ARM CMSIS functions access Core registers in unprivileged mode?
This question seems to arise from a confusion between Thread vs Handler modes and Privileged vs Unprivileged modes.

To quote the Cortex M4 Technical Reference Manual:


  The processor enters Thread mode on Reset, or as a result of an exception return. Privileged and
  Unprivileged code can run in Thread mode.
  
  The processor enters Handler mode as a result of an exception. All code is privileged in Handler
  mode.


Necessarily speaking, the processor would need to start out in privileged mode so that key setup configuration can be accomplished.

An operating system or stack sophisticated enough to make use of an unprivileged mode would then need to explicitly activate it to impose those restrictions on "user" code.

If no part of the code on a system manipulates privilege levels, then whole thing is running in privileged mode, just as it might on a simpler processor not offering a distinction.