Please refrain from attacking me again and read this whole comment.

I called your usage of XSS (cross-site scripting) a buzzword because you keep repeating it without realizing that it means literally the same as third-party scripts. When we say there's a cross-site scripting attack, this means a third-party script is coming from an unexpected source. It wasn't the owner of the site who put it there.

If there's an unprotected site (https://microsoft.com/) with a comment form, for example, someone can abuse it to post a comment that loads a script from his own site (https://example.com/evil-script.js). That's an XSS/third-party script attack.

If you open https://microsoft.com/ with NoScript or uBlock Origin set to block third-party scripts by default, any connection to https://example.com/evil-script.js will be blocked. Firefox won't even download the file. The two extensions do the same exact thing to stop this attack. There's no magic, and you've been misled by buzzwords.