Isn't the same true of those who use a library that wraps SQL?

I would think manipulating CSS through user input is both less common as an application pattern and less critical as an attack surface.