From what I’ve read, the beta is using a lightweight browser to run the JS but later versions will use a native JS engine. The JS is loaded externally because

From what I’ve read, the beta is using a lightweight browser to run the JS but later versions will use a native JS engine. The JS is loaded externally because that allows add-ins to be referenced by url in the .xls XML, which means they can be managed via a process similar to a package manager. Along with opt-in installation of add-ons, that’s definitely more secure and update friendly than, e.g. packaging the JS into the excel files themselves. But to be fair, it does seem like you should be able to compile your JS and host it in a public repo on the MS website, just like you can host an npm package on the npm website.