Actually, it's way worse than that. They were directly loading code from someone's CDN: https://github.com/iotaledger/trinity-wallet/pull/2565/files...