CSP would only be necessary if the SRI-covered stuff had bugs that let it accidentally load unverified resources. (To be clear, I think CSP is a necessary defense-in-depth measure for everyone, but this case doesn't uniquely require it.)