If we take the position that CDNs are not to be trusted, how many other high profile sites would be rendered vulnerable? I assume quite many are nowadays using

If we take the position that CDNs are not to be trusted, how many other high profile sites would be rendered vulnerable? I assume quite many are nowadays using CDNs to distribute part of their scripts. Wouldn't it be quite easy to for example to steal users Dropbox passwords if one could modify some of the scripts they use on the frontpage and which are delivered via Cloudfront?