The code they source from the third-party initially can be audited and then self hosted. If the code is not self hosted, the third party can change the script to be malicious (or be compromised) without the first party ever knowing.