We have a few instances of this across the codebase. At the moment, we don't have a reasonable way of excluding the browser-inserted style/script/whatever in the presence of a server-delivered policy. It's non-trivial to implement, and though I think it's probably worth doing, it hasn't bubbled up as important enough for folks to spend time on.

Triaging accordingly.

#1 - here are two probably-easy-to-implement ways to improve this -
- You can move the content of that <style> to a user agent stylesheet (view-source.css already has some of the rules used by the XML viewer). That sounds easy and will already improve a lot.
- You can switch any JavaScript implemented expand/collapse to <summary> and <details>. That might require ::marker (not stable yet) to make it look the same, but even without it, it is better than the current situation. Less easy, I guess, but does not sound a lot harder.

Alternatively, you can make it fully use the view-source mode when (a relevant?) content security policy is active.