If sites start moving to HTTP/2, is it true the untrustworthy code can be inserted into the same stream as the "content"? Everything could be coming from the s

If sites start moving to HTTP/2, is it true the untrustworthy code can be inserted into the same stream as the "content"? Everything could be coming from the same domain/IP? This might make blocking ads and tracking more complicated? My solution as HTTPS spreads is to MITM my own connections so I can see what is being sent and received over the wire. As the article says, it is a PITA. But it is necessary.