Why is it possible to embed someone else's code in http?

Question

HTTP headers

Faced such a situation that on http when opening the site there was someone else's script in the code.
Why and how is it possible to shove code to third parties in http and how does https save from this?

Answer 1

https does not save from this, if the server is broken, it
saves from the provider with a competent user, with an illiterate one (puts any certificates) it also does not save