Why can’t a malicious script read a nonce from the CSP Header and decorate itself with the nonce attribute to “whitelist itself”? Or is it too late at that point and the script has already been blocked by the browser?

I guess I just need to understand how the CSP and nonces actually work. Thanks. There is a similar question, but I am not sure what happens when the malicious script reads the nonce from the header and whitelists itself.