I’m not so sure that css3 and html5 will ever get so fast that it’s basically the same as webgl.
Structurally, I’m fairly certain Webgl and Css3 have different purposes.
WebGL is essentially a 3d canvas tag. It works using javascript to interact with the graphics card.
Every other browser maker has added support (though safari has it disabled by default)
As far as security issues go, last I heard any issues were fixed in the specification. Plus you have activex and NSAPI plugins, and various other venues of attack, yet people still use java and flash.
