Huh? But there are integrity checks (none in htmx case, which is strange), to prevent exactly this attack.