Sounds like Chrome is finally taking steps to combat that, as the post mentions they plan to "Restrict how, and for how long, Chrome stores site content provided over insecure connections"
PoisonTap is a particularly good example of how devastating this type of attack can be: https://github.com/samyk/poisontap
Thankfully the impact of this is limited in modern browsers as the cache is partitioned by site.
Which, incidentally, also removes the last fringe benefit of those free "JavaScript CDN" services. They are a strict net-negative now.
Though small, isn't convenience a benefit? I think a lot of new developers especially find it marginally easier to copy a script-tag.
This was noticed when a Google engineer went on holiday, and stayed at a hotel with dodgy Wi-Fi that copypasted ad scripts into anything that looked like jQuery. Said engineer realized that his laptop was still getting hit with the hotel's ads for months afterwards, because it had managed to poison one of those "JavaScript CDNs" that a lot of other sites use.
This is, of course, an attack - a hotel that can get an ad script onto arbitrary sites by rewriting one unencrypted request can also add a script that, say, siphons information off of any other site it got included into.