[lmm]

If they're MITMing they could replace whatever JS you put with something else, by definition.

[ncallaway]

While this is true, a parent comment from the user you're responding to has already explicitly mentioned this as a potential issue:

"It won't stop a nation state modifying requests in transit and injecting their own js but it will probably stop a nosy sysadmin."