Furthermore, having one extension to trust for security's sake is much nicer than having one for each and every site you want to custom theme. Especially since the general theme is going to want to build up a library of themes and requires user trust to do so, phoning home secret information would eventually destroy that trust. But an extension that only themes Google.com is a more likely candidate for harvesting credentials, for instance.

Creating an extension is also a browser specific process. If there's one browser extension for all sites backed by a repository of plain CSS themes, then users on multiple browsers can benefit from theming with minimal porting effort on the part of the theme author.