In my opinion this can't even be labeled as a single HTML file, because it loads external files to complete the app. But back to the question, a "plain html" file doesn't load any external resources and is usually semantically described.
One word answer - security.
Any website you visit could have been compromised and serving malicious content. Upon first visit to a website, I block all connections to domains not in the address bar, then go back in and add rules to allow connections as needed. It doesn't address malicious activity by the site directly, like a server compromise, but does limit non-addressed connections, including ones to local addresses.
For example, a compromise of .google.com which leveraged assets/code from .googleusercontent.com wouldn't initially be able to run, unless I added a rule to allow the connection. Likewise, a compromise of *.discord.com that made a connection to localhost:8983, then tried to send that data to someserver.ru would get blocked and logged. Where this can't protect me is if the server sends the mined data back to itself, then forwards that data on using its own connection.
Ad networks sell to anyone. Malicious content can be injected almost anywhere. Its happened before; it'll happen again. This web browsing hygiene has protected me enough times for me to make it my standard practice.
Agreed - which is disappointing.
My firewall shows blocked connections to cdn.tailwindcss.com and unpkg.com