Your example is how the site got infected. The types of infection is listed 2 or so paragraphs above that

What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?

That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.