I believe they can, comcast actually has injected javascript into websites in the past using a similar technique.

https://gizmodo.com/comcast-to-customer-who-noticed-it-secre...