This isn't true at all.

Anything SVG does maliciously, it does by containing JavaScript, so SVG's worst case is a subset of JS's.

Remind me again what the ratio of browser sandbox escapes coupled with full RCE is between JS, CSS, and SVG?

> then both CSS and SVG are significantly more risky.

how???