Whilst CSP wouldn't have stopped the modified script from loading it would have stopped the AJAX call to the attacker-controlled domain and thus would have been

Whilst CSP wouldn't have stopped the modified script from loading it would have stopped the AJAX call to the attacker-controlled domain and thus would have been rendered impotent. Whilst it is very worrying that a bad actor was able to get their malicious script served up by a BA server, even if it was only acting as a proxy for a CDN, I suspect that the reality is (or at least should be) that this is much easier than changing the headers sent by that server (and hence the CSP) and that access to one does not imply access to the other