As for your app becoming reliant on Google's version of the framework, you can always download the JS file they've been serving and host it yourself. You can't get locked in that way.

This misses the point. I'm not concerned about where the file comes from. If breakage occurs with regard to where the download comes from, a few customers get annoyed while you fix it (or even better, you implemented caching and customers never know the difference). That's a normal and expected maintenance issue that you plan for.

What I'm really talking about is the content of the file. If Google fixes bugs or adds features and you don't realize it until your app has become dependent on Google-specific changes, it's not an easy thing to fix. This is a different problem than getting screwed over by ad providers.

Maybe one possible solution to my concerns would be to keep a table of sha1 sums of the version you want to depend on, and check them periodically (randomly select 1 of every 1000 visits to receive the checking code that reports back to your backend).

I just have an instinctive wariness of this kind of dependency, even if the cost of avoidance is a performance penalty.