Attackers can exploit CSP to block requests to legitimate domains

If an attacker executes the following js, it can restrict all request to only `polyfil.io`:

```js
document.head.insertAdjacentHTML(
  "beforeend",
  `<meta http-equiv="Content-Security-Policy" content="default-src polyfil.io">`,
);
```

Is there any way to avoid this from happening?