> There is little excuse to not set a strong CSP on your sites
Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd love to securely monetize a few webapps of mine.
true, but
> if you can
IIRC that excludes every website with Google Adsense and even just using a manual ad network includes always fiddling with your CSP.