Right, but that's just a social distinction. It does nothing to protect users from careless web developers, and it does nothing to help web developers be less careless.
Please, somebody think of the users!
There are obvious technical solutions to this, but people seem unwilling to acknowledge that they might even be necessary.
trusted: I wrote it / looked over the source code
untrusted: I pasted some <script src=http://gonnaHackU.com/blah.js>; into my page.
Including <script> tags from external entities is always a potential security risk. And it's always better to do it serverside if at all possible.