The nuclear option that left three doors open
The policy starts by denying every resource type and then re-allows exactly what the page needs. The reasoning is sound: deny everything, permit deliberately.
Three directives do not take part in that fallback at all. Absent, each one allows everything — so this policy leaves the page framable by anyone, lets an injected tag re-point every relative URL on it, and permits a form to post wherever it likes.
Outside every boundary: The page, Any origin (a form posts here; FAILED: unrestricted), Anyone's iframe (FAILED: can embed you), An injected <base> (FAILED: re-points URLs), default-src 'none' (the catch-all rule), an empty slot for the who may frame you, an empty slot for the what may set the base, an empty slot for the where forms may post Connections: default-src 'none' controls The page — denies fetches (step 1) The page controls who may frame you (step 2) who may frame you must NOT reach Anyone's iframe — cannot embed you The page controls what may set the base (step 3) what may set the base must NOT reach An injected <base> — cannot re-point The page controls where forms may post (step 4) where forms may post must NOT reach Any origin — cannot post here