Nor might a consumer expect escaped outputs. Using my iOS example, the consumer would end up with malformed data and be required to manually unescape every API

Nor might a consumer expect escaped outputs. Using my iOS example, the consumer would end up with malformed data and be required to manually unescape every API response. Assuming all data should be escaped is a very HTML centric view, and only applies to one (albeit popular) consumer of the data. For example, we don't store html escaped data in the database for the same reason (we don't know in what context the data will be used).