then be served to other users?
Yes, and that JS can do whatever it wants, just like a full script tag, with a few minor inconvenient syntax restrictions.
If so, isn't this an issue with the fact that a user somehow has the
ability to serve whatever they want to users from your site?
Yes, you don't want that happening at all, CSP or not. You want to convey the user's intent, not republish the user's input. CSP is not the front line of defense, it's a backup to mitigate the harm from mistakes like not enough sanitizing, too-smart template engines, and plain bugs.
How is this a CSP problem?
It's content, and it relates to security, so the Content Security Policy is a good place to address the issue, right?