Unsure I really understand the XSS risk that's discussed in the links you provided. Nobody cares about that origin because it has nothing of value hosted on it and it's not like you'd be able to access cookies from a different origin.
The worst you could do is exploit a browser zero-day, but you can do that on any static hosting site already!
The worst you could do is exploit a browser zero-day, but you can do that on any static hosting site already!