Want to know how you can easily stop this attack? What
I've done here is add the SRI Integrity Attribute and
that allows the browser to determine if the file has
been modified, which allows it to reject the file.
This is a product that works by running a script on your page to make changes. There's no option for defense in depth here: either you trust that their processes are secure enough that they're not going to XSS you, or you shouldn't run their code on your site at all.
The bar for including javascript from other sites should be a high one, but there are times when the tradeoff is reasonable. For example, I have Google Analytics [1] on my site, and I trust them to handle this responsibly.
[1] Disclosure: I now work for Google