It seems like "code from a zillion servers, retrieved over a zillion TLS connections" can be solved by serving the app from a single origin. You have to vendor your dependencies but that's probably wise anyway.
After all, they could easily serve up slightly different js when you log into their website; for all practical purposes it would be undetectable.
Being reasonably confident that you're running the same code as everyone else seems pretty important to me - and that's not how the web works.
Which is why people say E2EE is unsuitable to the browser.
Sure there exists other threats and other security issues in the browser, many of which can be addressed by various means, but that is a different thing than E2EE.
I guess the separation into CDN and non-CDN stuff could still make sense since you can serve static resources from even closer to the user than you serve your dynamic stuff while avoiding having the CDN proxy traffic to the website backend.