Sure there is (I agree js doesn't know the difference, but we do, and we are the music makers).

trusted: I wrote it / looked over the source code

untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js>; into my page.

Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.