Because a properly configured content security policy will block any inlined js (and external js files on non whitelisted domains)