Why is a nonce-based CSP stronger than a host allowlist?

Short interview answer

A host allowlist trusts every script served from listed origins, and a single vulnerable endpoint, open redirect, or JSONP callback on an allowed host can be abused to run attacker-controlled code. A per-response nonce only trusts scripts the server explicitly stamped for that response, which an injected script can't guess.