Why does this matter? Most 3rd party services are "reasonable" in some setting. When you build a highly-sensitive application, the bar for reasonableness changes.
This is a world where internet banking and healthcare, arguably the canonical 'highly-sensitive applications', are using 3rd party js services like this. I think we need to redefine 'reasonable' as the industry clearly isn't acting reasonably (IMHO).
There is no reason to accept that your bank runs javascript from third parties. Complain and use only in an environment where you can block them. While it may seem futile to report these transgressions to big institutions, the fact that your complaints are logged helps those fighting these stupidities from the inside.
The overwhelming majority of online financial services would self-host everything. It's not strictly a PCI-DSS compliance requirement, but it is common sense and industry standard.