I would think manipulating CSS through user input is both less common as an application pattern and less critical as an attack surface.