The issue with many of these major problems are (especially regarding 3rd party scripts): 1) They are easy to add 2) Economic incentives are not aligned with

The issue with many of these major problems are (especially regarding 3rd party scripts): 1) They are easy to add 2) Economic incentives are not aligned with technical rigor and security. 3) No matter how much we write and post on this forum, we're shouting into a void composed of the 80% of developers who do not care, and the 100% of people who pay them who do not care. Why should they care about the occasional user getting compromised by russian hackers? "Not my problem" attitude won't get fixed by social enforcement. 4) Progressive web apps + modern stack need an expert hand, and are not straightforward to set up in most cases. Much more difficult at any rate than setting up a quick react app. Next.js and others do well at making this less difficult, but see #3. Everywhere I've worked that just shipped a "static" SPA, doing so did not materially affect the business over shipping progressive functionality. Embracing "rigor" was seen by a waste of time to anyone who had a hand in task scheduling, and why should they care? No PM or startup CEO is going to care a whit about anything this article talks about, unless it happens to be central to their business.