Currently, observers listening to ACL updated events systematically cast the ACL profiles argument to a Set of String but the Collection is always sufficient.
If someone use a List for the ACL profiles it will avoid an unhandled cast exception.

If we wanted to explicitelly restrict the type of this parameter to a Set, we could, but currently there is no explicit reason to use a Set.