More specifically: A public CDN whose content they don't own, and that can change at any point in time. If it would be a private CDN which points only to the c

More specifically: A public CDN whose content they don't own, and that can change at any point in time. If it would be a private CDN which points only to the content they explicitly published as part of a build&release process they wouldn't have the problem. If you rely on public artifacts that others published, all your availability and security guarantees are gone.