Yes, though again, throwing out a checkout session for anyone running that extension isn't wise.

"If GA is unreachable then window.ga wouldn't be defined."

The legacy code you insert for GA does: var ga = document.createElement('script'); first, then loads GA. Wouldn't that have the same issue if GA is unreachable?

Doesn't matter. Anything that is not the main goal (in that case, the checkout process) should be isolated and not break it.