you can change the payload sent to users, static or not. If you serve javascript you're serving dynamic, runtime dependency injecting code.