I’d add fonts and other assets to this as well. The security implications aren’t as serious as for JS files, but the reliability, versioning and privacy benefits are just as real.

There’s a performance benefit to be had as well. Modern web protocols (HTTP/2 and HTTP/3) are built to anticipate additional files you’re going to need and send them alongside the page reply, saving the client browser from having to go back to the server to ask for them. If you’re loading a hundred SVG icons and a couple dozen other files, that can make a big difference to how quickly your page appears. But they can only do that for files on the same domain – any files you load from an external source don’t get that benefit.