> As for loading random JS, yeah also seen that done that before.

Partner A is not random JS. The assumption there is 1) you have some official signed agreement with them and 2) you've done your due diligence to ensure you can use them in this way.

It's not just some person's GH repo who can freely change that file to whatever they want.

Hotlinking is as old as the internet, and a well-worn security threat.