Every <script src="https://cdn... "> on your site is a standing grant of full JavaScript execution to whoever controls that file tomorrow. Not the file you reviewed, the file the CDN serves on the next request.
Source: [Dev.to](https://dev.to/muhammadalimughal/subresource-integrity-sri-pin-your-cdn-scripts-2flc)