The advent of CSP really ruined the bookmarklet party, because the browser would obey the CSP headers, rather than the user whose computer the browser was running on, preventing a slew of bookmarklets from working due to script loading being "forbidden" by the server whose pages you were trying to run your bookmarklet on. By the time browser makers finally tried to address that, the damage was already done.