If you are saying that people click through certificate warnings then people definitely would just permit whatever script. The number of people who will say "ye

If you are saying that people click through certificate warnings then people definitely would just permit whatever script. The number of people who will say "yeah its okay that this is a self-signed cert" and also say "no, I have a strict allowlist of verified scripts from this server that I allow to run" is miniscule.