In reply to Otto.

How is this any less of a security concern? What if the Gutenberg Cloud CDN is compromised and someone inserts malicious JS? The script has credentials to send queries to your website's REST API. If anything, the security concern is worse because the code can be changed at any point in time without being vetted or detected server-side via scanning.

Let's not split hairs about what constitutes installable code. The risks are inherently the same, if not worse. Either way, the code has access to virtually all data from your website's database.