Depends on if you are serving the content-type correctly on your js files. It is a common misonfiguration for js files to be served with text/html content-type. This won't break a page including the js file, but it will cause a modern browser to render the file as html if the url is enterred directly in the address bar.
A scammer can send bogus urls via emails to targets in hopes that they will click the seemingly safe looking url. But if the js files is served as html and rendered, then they can execute arbitrary js code on the client and potentially exfiltrate cookies or any other confidential information available to that page. Worse, they may even be able to take advantage of any zero-day vulnerabilities that may exist in the client browser.
In practice I would say to fix up that mechanism so it is less dependent on url manipulation, but in theory you will be much safer if you ensure you are serving the content-type as text/javascript