As import() is just being implemented (https://groups.google.com/a/chromium.org/d/msg/blink-dev/wRLMM5-kpCY/Y0be_ASaAwAJ), we have a good opportunity to get more strict about content type validation.

It looks like the current behavior in Chrome is that specific media content types (png, etc.) will not be loaded as script, but other non-script types (at least application/octet-stream and text/plain) will load as script.

I'd like to propose that import() switch to an allow-list strategy. 
 Maybe it's not too late to do the same with the import statement as well.

Mike West reports that the implementation here is in the Fetch code.

Also, for reference:

Twitter thread: https://twitter.com/randomdross/status/883035368391561216