This will have been pulled in as a dependency in many projects and the site either works or does not based on the presence of the bundle.
This wasn't bundled. People inserted a script tag pointing to a third-party CDN onto their sites. The output changes depending on the browser (it only loads the polyfills needed for the current browser) so you can't even use a subresource integrity hash.