[elmigranto]

> if someone manages to inject arbitrary HTML

If they can, why wouldn’t it be inline <script>?

[amluto]

Because CSP can be configured to block inline scripts.

[jsheard]

The syntax to allow inline scripts is even "unsafe-inline" to emphasize that you are entering the danger zone.