I think they point they're trying to make is that there's no guarantee the script you get isn't hacked unless you use SRI. The focus isn't on third-party javas

I think they point they're trying to make is that there's no guarantee the script you get isn't hacked unless you use SRI. The focus isn't on third-party javascript, but un-secured javascript.