You are correct, it does work.

My mistake was basing my statement on past experiences using an older Firefox ESR version which would give "Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)." when clicking on a bookmarklet for sites like Twitter or Github.