I don't know what industries you've been working in but in any sensitive business third-party javascripts are under the same tight controls as any other code, and changes in javascripts are going through the same change management controls as any other code before entering production.

Even Google have had issues with malware being distributed via adsense: https://www.businessinsider.com/google-has-shut-down-a-malic...

Not to speak of the Megacart hacks: https://www.riskiq.com/blog/external-threat-management/magec...