Sorry for the post above.
I discovered that this is the result of the plugin determining that I, as WP admin, was on the site being tracked by Hubspot while logged in as the WP admin user, so the code is present only in the HTML of the page that that specific user is viewing, and visible only to that user.
(Hmm, that may not be the most clear explanation, but TL;DR is: my security concern was unfounded, there is no problem.)
Thank you.
