I've only ever seen userdir URLs hosting static content - ideally, static HTML with lesson plans or a resume or something. Why would anyone host a web application on a userdir? This seems like a complete non-issue.

Also - why would a blog be threatened by XSS? A blog is a collection of static HTML files and I assume the creator would be using a composer or just a text editor + browser to add and edit pages. Why would anyone log into a blog? Nowadays anything like a comment section is generally handled by iframes to some other service (like Disqus) anyway.