TBH I wonder why response header requirements can't be set right in the meta tags in index.html. Would this be any different than having a provider-specific config file next to index.html from a security pov?

Some of them can be, but not all. Some headers are needed before the content is loaded. With ubiquitous virtualisation these days, I don't see why hosting providers can't allow users more control over their server without compromising security.

You don't even need virtualization at all. Apache have allowed this for twenty years!

All PHP (Apache) hosting provider I know allow user-defined configuration on a per-directory level.

> something as basic as CSP is also crippled without access to the server to set headers

Why would communicating sequential processes be crippled by this?

Ah, I see. A different namespace.