What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?

That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.