This is a world where internet banking and healthcare, arguably the canonical 'highly-sensitive applications', are using 3rd party js services like this. I think we need to redefine 'reasonable' as the industry clearly isn't acting reasonably (IMHO).