But if the fundamental issue is that the JS code that runs in your browser is provided by the same entity providing the back-end, couldn't we have a different e

But if the fundamental issue is that the JS code that runs in your browser is provided by the same entity providing the back-end, couldn't we have a different entity that -on a different domain- serves JS code that interacts with the backend of the original service? I know this is not the case now, but this is theoretically a possibility, right?