> I found that if you scan your site for CSP headers, none of them shows up

Some scanners ignore them in the meta tag, looking only at HTTP headers (just like some browsers). I thought Netlify would merge meta CSP into an HTTP header, but it seems like this is not the case.