It’s absolutely possible, but almost nobody does, at least until they get breached.

Developers have decided that the convenience of just letting their servers pull arbitrary code off the Internet is more important than the security risks.