Yea I think CSS is ok

Letting CSS is okay, as exploits shouldn't be able to run from it.

Then why wordpress has this in the CSS comments?:

(Wordpress lets users customize only the css)

Hmmm, in theory, browsers should parse CSS as CSS and nothing more. Haven't tested this across multiple browsers though.

This will be useful.

http://htmlpurifier.org/

Are there any options to limit HTML to "trusted" users, perhaps admins and moderators?

Not in stock vBulletin. There is a modification that does this though.

CSS can be dangerous too. There are even some vulnerabilities which rely on CSS, such as the cursor exploit.

Do you know the name of the modification? I'd love to use it.

Not off the top of my head.