In those cases focusing on security is IMHO the wrong thing. Those JS/HTML/CSS text boxes are user hostile as the developer basically expects user to be able to write code, where sometimes it is even hard for users to just copy & paste code.
In the worst case when the customizer is not used, some validation/sanitisation should be done to prevent the site going “down” due to some syntax mistake, especially since usually those options do not have an undo functionality.
As for the security aspect, CSS can not be made secure IIRC due to it being able to include SVG which may include JS. If only the admin can edit the relevant CSS, than as you say there isn’t much of a problem, but keep in mind that admins in a network are not true admins of the whole site and they should not be given access, or alternatively you should check for an unfiltered_html capability before accepting any change from a user.
Last and not least, 4.7 already has a CSS editor, do you really need to reinvent the wheel? If any CSS can go in your settings, and you don’t do any special processing on it, than just use the core facility.