Yeah, I work on some public-facing sites that have analytics and programmatic ads and the like. Our list of script and frame allows would be pretty long. And since the analytics team own and operate out tag manager, they can inject third-party scripts at will without needing a release which makes maintaining CSP a whole job on its own.
Isn't that the majority of the web today?
Indeed, but it's messed up that we had to invent all this new standard just to keep including hundreds of Analytics scripts