setting cssText rather than style

Aftr reading through the discussion on #212, it's still unclear to me why a CSP policy of style-src-attr 'self' will disallow:

dom.setAttribute("style", "background-col
5D1E
or: blue;")

but not:

dom.style.cssText = "background-color: blue;"

Why is it safer to set the cssText rather than the style attribute?

Provide feedback