HTML and CSS are content, not software (they're not executables) - they're like DOC or PDF.
Well… https://keithclark.co.uk/labs/css-fps/
You could also argue that DOCs and PDFs are software.
I'm sure he'd agree that people should also not include proprietary software in those files as well, but doing so is far less common than webpages, at least for stuff the average user is going to run into.
And how many people are actually programming in HTML/CSS vs JavaScript? A proof of concept is one thing, but most users won't run into it.