"A browser is required to load resources whether or not they come from they come from the same domain " False. A browser could easily be configured to block or

"A browser is required to load resources whether or not they come from they come from the same domain " False. A browser could easily be configured to block or prompt before loading 3rd party content (early versions of IE use to do this). It would be very annoying, but it's possible and that's where we're slowly going with all the cookie/gdpr popups. There's always a tradeoff between security and convenience. People are trying to legislate what should be a technical solution.