> It’s not uncommon to freeze 3rd party libs

Sure. 3rd party libs your code uses directly.

Haven't seen it too much with 3rd party service providers code that are somewhat outside your code boundaries. Taking 2 different popular 3rd party SaaS that are included as JS in sites as an example.

Google Analytics uses url of https://www.google-analytics.com/analytics.js [1]

Stripe uses url of https://js.stripe.com/v3/ [2]

< Do you want a 3rd party provider to have access to hot deploy to your website?

Clearly not. Nor was this inferred.

[1] https://developers.google.com/analytics/devguides/collection... [2] https://stripe.com/docs/stripe-js/reference