True, although it doesn't really work in practice, because your third party resources change for non-malicious reasons a lot (they wrong doing so, it's bad prac

True, although it doesn't really work in practice, because your third party resources change for non-malicious reasons a lot (they wrong doing so, it's bad practice, but bad practice are everywhere, social problems and technical solutions, you know the saying). And if you use SRI you end up with a broken website every once in a while and you need to monitor it and ship a fix ASAP (but there's always downtime if you want to make sure the change wasn't malicious before updating the signatures on your website). Nobody really cares about security, stakeholders just want a good looking enough security theater.