The point is that it's an arbitrary user submitted script. In this case it was just the time, but it could have easily been a botnet command and control message or some other malicious content.

It's standard security practice to serve user submitted content on a separate domain, so I'm a little surprised that Google isn't following it.