So what part of the proposed solutions "wouldn't work"?

Not sure what you're referring to by "custom endpoints" - if you are a normal Datadog RUM user you can only ever send data to one of the several "sites". There's nothing customizable.

Having something is better than nothing! In our case, having connect-src enabled would have avoided the incident.

Yeah, I wouldn't recommend anybody go and quote the ruling right now (unless you're very loaded like this guy)

Only the very short stretches (e.g. from Berlin to Lutherstadt Wittenberg)

In pnpm you can override this. I don't think you can in npm.