SRI only really works if the 3rd-party script never changes, in which case why is it a third-party script?

If it changes and the hash no longer matches perhaps due customer changing config then the site is faced with the challenge of either the browser refusing to load the script (with potential breakage) or reporting the change which then is probably ignored

It's not really a simple fix for the way the web is built today

usually scripts have versions, this protects you from compromised cdns as well where you publish assets in a different location compared to where your frontend is served.

If a library serves a script and your site manages user funds you should probably avoid using it or use a cdn that does.

I am not quite sure, but there's also other integrity mechanisms that gurantee that a file was signed by the library developer via a served header with the signature of the file.

Letting any vendor arbitrarily update code running on your customer's computers without even your knowledge is insane.