this is a shop owner account security problem. if someone can place the required malicious google tag on your site, they could also do whatever else they wanted. they could put any custom JS, for example. this stealer is just one of many payloads.