Any extension that injects JS on the page on arbitrary sites, is marked as having access to all data—because it does. But it's the only way that interface-modifying extensions can work, if you want them kick in automatically.
It'd be nice if there was a browser permission along the lines of "this extension adds a static asset to every page" or "this extension can _write_ but can not _read_ the page".
To add static CSS styles, you need to know the structure of the HTML in advance, which the extension doesn't. And to modify the DOM—even to add styles on it—you need to traverse it, i.e. read. Plus, the whole job of the extension is probably to figure out what styles are on the page already and how they can be fiddled into the darkness.
To redefine styling in CSS, you need to know the structure of the HTML for a specific site or page. If you don't know it, you need JS to poke in HTML, fiddle with the styles and hope that it works out alright.
