> We've just shifted from "quiet, persistent threat" to "hacker announces to the world that he's in". Changing javascript on a prod website is going to trigger alarms.

While I'd like that to be true, it really isn't. There have been loads of card skimming operations injected into production sites which weren't noticed for sometimes months.[0][1][2][3]

[0]: https://blog.malwarebytes.com/hacking-2/2020/03/criminals-ha...

[1]: https://www.wired.com/story/british-airways-hack-details/

[2]: https://www.riskiq.com/blog/external-threat-management/magec...

[3]: https://sansec.io/research/svg-malware