For sites like Google, this is either a calculated risk, or not even applicable for them.

Scanner services like Mozilla Observatory / securityheaders.io / Qualys / etc only test a preset list of known best practices, they can't judge whether that technique is applicable for that site.

While it's usually good practice to follow the recommendations of such scanning services, you must always make sure you understand the implications.

Haha, yup, that's one of the tests I did as well. Most sites score terribly. Honestly, I was just experimenting (and for my static sites this doesn't really matter so much), yet it feels like there are a lot of issues with CSP that really don't need to be there. Until then, adoption will probably be slow / non-existent.