Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the

Being able to serve JavaScript from Google's own servers makes it easier to do a cross-site scripting attack against someone else's Google Drive site. Since the malicious JS would be from the same origin, it's no longer cross-site, and gets a free pass around some of the browser's anti-XSS features.