The risk is via side channel attacks like Spectre. Even if the script fails to execute (since it's html and not javascript), the html document has been loaded i

The risk is via side channel attacks like Spectre. Even if the script fails to execute (since it's html and not javascript), the html document has been loaded into the memory of the process which included the script tag, which can now start reading that memory via side channel attacks.