Credit card skimmer masquerades as favicon

If I understand correctly, the browser would need to accept text/html as a response to an <img /> tag. Why not just disable this/drop the response if it isn't an image MIME?