My take on this is technically they do, the shouldnt be on a non secure version, where breaking changes are minimal/none. CSP been a security based package does make this easier for me to justify my position though 😄