They also added, like, 80MB DLL (AFAIR, chromium) just to render HTML MOTD at some point.
I personally had to rewrite most of mod's VGUI code to make it less leaky and more usable, and not once have I thought of using CSS instead of those INI-style theme configs. But CSS is too complicated to parse (and no one will use that anyway). :(
Originally it used Windows's built-in embeddable IE thing, which as you can imagine was not stellar for security. IIRC there have been some incidents with bad servers serving up MOTDs that exploited vulnerabilities in Trident to execute arbitrary code.
I believe they switched to Chromium while preparing for the OS X port. You'd think this would be good for security, but they then proceeded to update to the latest version approximately once a decade.
I know a lot of servers exploited that as well to play music in the background... in retrospect, the idea of a web view hanging around while you're in a game is terrifying.
