Because nobody has tried attacking them

Yet

Or have they? How would you find out? Have you been auditing your outgoing network requests for 1x1 pixel images with query strings in the URL?