Hopefully , it will be very hard to insert clearly malicious code into a CDN.
Is CDN code highly likely not to be malicious? Yes
Should you the CDN domains be whitelisted for an ecommerce ? No (*)
It is possible that a CDN can be compromised. They have in the past (and there are many kinds of CDN, and each will have their own security practices), but I find very unlikely that a malicious file placed there.
Perhaps you could find out a formal reason for excepting them, such as them holding X certification or passing certain security audits. This is probably what you will do for excepting the payment processor, ("it is eligible for being exempted as it is PCI-DSS certified"). But while some CDNs will probably pass that bar, here it is much easier to just copy locally the few files you need.
Having a clear policy will also be helpful when someone requests a new exemption (why won't you allow shadyhitcounter.com? You are already allowing GoogleCDN!), and requiring an approval process for adding a new script ("why do you need to load this script deprecated 10 years ago? Here, see this improved version over the sample you copied from the web").
Now, while my answer for that is a straight No if you were securing your shops, I softened it to No (*) given that you seem not to be protecting your own stores, but to be in a middle situation, such as a hosting provider struggling to secure them in a best-effort basis but no control over the content.
Needless to say, it is obviously preferable to have a weak CSP than no Content Security Policy at all. And the fact that untrusted people routinely get admin privileges seems like a security nightmare on its own!
(note that by "untrusted" I do not mean you have to be malicious, it may just mean that you have not proved that you are not a security inept)
I'm not sure how CSP-ready Magento is. In the likely event that you need to allow
As important as getting a sane-enough policy, it is IMHO that you set a
report-uri and actually review them somehow, as they are very likely to provide an early heads-up on any site compromise. Be aware however that there will be false positives, and impossible blocks. I have seen CSP block URLs that are nowhere to be found in the page. I ended up concluding that in some cases they must have been added by browser plugins (maybe malicious, maybe not).
Regarding the difficulty of moving the code locally, please note that -since you are apparently in control of the webserver- it would be quite easy to replace the CDN domains in the html output with the local hostname / your own domain used for cdn resources, with minimal risks.
Finally, let me link you to the I’m harvesting credit card numbers and passwords from your site. Here’s how. article by David Gilbertson. Their objections FAQ are really valuable on how a careful attacker might sneak by.