Stylus is CSS-only. There are other extensions that allow adding both CSS and JavaScript.

That's a problem with Basilisk, not with Stylus.
Stylus doesn't have any code that prevents it from being uninstalled.

Stylus doesn't access any data on any site. The new content script for openusercss will simply facilitate installation and updating of usercss styles from that site.

The content script tells the site the name of the extension (Stylus) and whether the style (displayed on the site page) is installed so the site displays the extension name and "Install" or "Update" on its action button.

The fact that Firefox displays this warning is just another example of how buggy WebExtensions implementation is in FF. It's really sad and disgusting. The thing is, Stylus has always had access to all sites via its content script that runs on all URLs - this is a necessary requirement to apply styling - so adding another content script makes no actual difference.