In reply to HackerThemAll's https://news.ycombinator.com/item?id=48659482 comment (which I think is a bit pretentious and unfair, and HN does not show my direct reply to the comment):
I think that's a red herring: the query is sandboxed DuckDB-WASM SQL (never executed as script), it's never injected into the DOM as HTML, and the page enforces a strict CSP that blocks inline script regardless. NoScript probably flags it because it's SQL-shaped text in a cross-site query string, and it matches its injection heuristic.