They can, but CSP is not being applied to the embed page, only the embed shell. The embed shell contains the make details bar and the iframe that wraps the embed, so we can have a much stricter policy here.

I think for now we will not be applying CSP to makes directly, since they can do just about anything.