Yes: it would be great if a site could use something like CSP to ensure that if they've only gotten consent for vendors A and B that vendor B doesn't go violate

Yes: it would be great if a site could use something like CSP to ensure that if they've only gotten consent for vendors A and B that vendor B doesn't go violate their contract by bringing in unconsented vendor C. (Though in this case B and C are both Google, and in a slightly different world both Google Pay and Google Analytics could be hosted on the same domain.)