Surveillance, sure. Like a MITM could be a threat, but a MITM is a threat for any HTTP request. And shouldn't forms still be posted directly back to the server

Surveillance, sure. Like a MITM could be a threat, but a MITM is a threat for any HTTP request. And shouldn't forms still be posted directly back to the server? If it's just a CDN I don't see how any confidential data could be leaked unless the server serves up your credentials in cleartxt. Perhaps I misunderstood you?