Hacker News Reader

But if the scenario is an attacker who can inject HTML tags, why wouldn't they simply run their script directly via <script>do_evil();</script>?

Because a properly configured content security policy will block any inlined js (and external js files on non whitelisted domains)