Yes. The website publisher would add this CSP header to ensure that the browser only loads sub-resources come from the first-party domain. It does not prevent the publisher from writing markup that declares third-party resource loads. The header ensures that the site will "break fast". CSP headers are often more useful in sites that allow clients to write markup, however there is still utility in declaring your intention to not load third-party content in your markup.