I periodically get told that a published browser userscript of mine is malicious or suspicious in emails simply because of the cautions and wording around the userscript installers themselves (it's just a css tweak, a theme), meanwhile the executables I have in the wild have generated zero similar feedback.
my theory is that since the script is more easily read that it attracts people to read it without any theory or knowledge of what they're even looking at .
Where something that can be verified gets more scrutiny than something that can’t.
Maybe someone else knows.