Vlad Your content security policy has unsafe-inline enabled (which allows running injected JS on older browsers not supporting strict-dynamic) and also has https://*.workers.dev in allowed URLs which are hosting URLs anyone can register, meaning the attacker could host their endpoint there.
CSP is not meant to be relied on -- inputs need to be sanitized and saying "there is no security issue here" is a gross oversimplification. In general, please don't dismiss security concerns.
Also note that the injection has a different mechanism than OP described. It only needs a misspelled word, and the following HTML is injected: misspeling<style>*{font-family:'Comic Sans MS'!important;}</style>
: https://kagi.com/search?q=misspeling%3Cstyle%3E*%7Bfont-family%3A%27Comic+Sans+MS%27%21important%3B%7D%3C%2Fstyle%3E