Yes, Google could run a different script than the one the site creator intended, and it's not hard to have a script send off entered information. However, the reaction upon getting "busted" doing that would be pretty severe among developers, and probably lawyers as well. There are terms and conditions, and contracts are to be followed by both parties. There is little incentive for Google to capture info they likely already have, so this is probably not a realistic concern.
You can see all the script's activity in the developer tools, including in non-chrome browsers. I suppose Google could engineer chrome in a way to cover up what script was loaded, as well as hide the ex-filtration http request, but we're getting really tin-hatty here, and there's other tools like wireshark that would ensnare them. In short, it's simply not possible to do this perfectly, nor worth it for them to do this in general.
If in doubt, and doubt is healthy, use the integrity attribute on CDN resources to prevent this exact scenario in supporting browsers (~60% at time of writing).
EDIT: There is a hidden privacy consideration here. It's not the info being entered, but everything else Google can tell by you using such a service:
- Who - Which user is loading the script (IP)
- What - What script; something for validating forms, watching vids, etc (script url)
- When - What time was the script loaded
- Where - What site/section/page is the user on (refferer)
- Why - Google's a pioneer in deep learning ;)
If you self-host the script, google gets none of that, and thus your users gain a little privacy.