The downside of not sanitizing inputs is that the data may well end up in contexts or new apps altogether wherein escaping output is not reliably done or known

The downside of not sanitizing inputs is that the data may well end up in contexts or new apps altogether wherein escaping output is not reliably done or known to be necessary. In an ideal world it shouldn't happen. But, it does, especially given turnover within organizations and the long lifespans of many systems and their datasets, lack of documentation, etc. So, this calls into question the viability of a strict policy for every scenario that encourages blithely storing <script>doEvil()</script> in the database. Seems some level of sanitization has a place as an extra layer of defense for some use cases.