Assume a business-crucial web-site of some company that is used to sell handsets to the customers worldwide. All the developed components are reviewed by the security team on a monthly basis. In…

Because the JavaScript files are hosted on the marketing company's servers, the website fetches and executes them at runtime in the user's browser. If those external servers are compromised or the script files are tampered with, the malicious code executes within the context of the host company's site - capable of stealing session tokens, credentials, or payment data from customers. The company's monthly security review only covers their own components, so any change to the external scripts goes undetected.

Client-side JavaScript runs in the user's browser sandbox and does not have direct network access to the company's backend servers or databases; it can only interact with what the browser exposes.

Even reputable third-party providers can be breached or their CDN compromised; assuming trustworthiness eliminates a real and documented attack vector known as a supply chain or watering hole attack.

Increased outbound traffic volume is a minor operational concern compared to the critical risk of malicious code executing in customers' browsers and exfiltrating sensitive data.