Pin your dependencies, don’t load CDN garbage on the fly. Control your build pipeline. These are basics for any good web development. To see this happen with money on the line blows my mind.
Free2Z has a very conservative approach where it doesn’t ask to play with your wallet on your behalf at all, much less with unknown, non-deterministic dependencies loaded from untrusted sources.
Zcash community should let web3 flail and focus on private, p2p, electronic cash (sent and received outside of the web browser).