Reason 1 to implement this security measure: When a resource is referenced on the HTML code with a different domain from which the same HTML was loaded, then a malicious actor could interfere in the DNS resolution on the end user's machine, to make the resource be downloaded from a different location. Thus, a resource referenced with "https://js.hs-scripts.com/***.js" could be downloaded from a malicious server with malicious code. This type of attack can be prevented if HubSpot adds a verification string that allows the browser to confirm that the received asset is the expected one, without alterations.
Reason 2 to implement this security measure: Even if there is no attack from a malicious actor. Security audits rise this security flaw as a vulnerability, causing reputational damage to the people maintaning the website and to the website's owner.
I'll upvote this as lack of SRI support can significantly negatively impact a company's percieved security rating (e.g. when using tools such as SecurityScorecard).
