Earlier quoted context omitted.
Another alternative is loading a library and setting it to a fixed version. You're still giving a 3rd party full access to your website, but at least it's more auditable and safe. Fwiw, I think iframes are great!
While i agree that is better than nothing, i've always had my doubts about this approach. Do people really audit such code? I doubt it. Does the code really not insert any additional code that allows bypassing the whole scheme (esp. If the point is to dynamically insert content). I also think most of the time, the biggest threat is not the vendor being intentionally evil but the vendor making a mistake that leads to…
How is that different to any other library? Supply chain risk is a big problem.