I think the benefits of leaning on a (very familiar) protocol instead of a central repository outweigh the risks you describe Like you mentioned- mirrors could

I think the benefits of leaning on a (very familiar) protocol instead of a central repository outweigh the risks you describe Like you mentioned- mirrors could become more common, and relying on HTTP makes it incredibly easy to host your own mirror. And import-maps mean you can mirror anything and everything in your dependency tree Let's not forget, back in the day every major site relied on a client-side request to a jQuery CDN :)