Trusted Types lets you do exactly this! You explicitly list the trusted types policies that you allow on your page, and if none of them declare the createHTML

Trusted Types lets you do exactly this! You explicitly list the trusted types policies that you allow on your page, and if none of them declare the createHTML method then there is no way to set innerHTML (even inside some a new version of some obscure dependency of a dependency, or in some script that an intern plopped into the page, or in some five year old code that seemed reasonable at the time that you've totally forgotten about... (not like that happened to me recently))