Using packages that load code from a CDN is risky because it bypasses the lock file, allowing the code to change from build to build without the developer's knowledge. This can lead to security vulnerabilities as attackers can insert malicious code into the remotely loaded script.