A CSP can be configured to disallow external stylesheets too. I don't see how that's particularly relevant. But obviously if for some reason a CSP was configured as such, and I had no power to change it, I'd work around it.