This is a thing on private tracker websites, at least Gazelle based ones. You can give a custom URL to load CSS from. Not sure I've used any other websites that allow you to do this, though I wish there were more that did. I think the odds of people being victimized with this are pretty low and people could just skim the CSS beforehand if they didn't write it.