> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"