I'm just baffled about how this hypothetical scenario would even happen. Did the author of the website never try rendering the page themself before pushing it

I'm just baffled about how this hypothetical scenario would even happen. Did the author of the website never try rendering the page themself before pushing it to live? If user-generated content is able to trigger this then you have have an XSS vulnerability on your hands, strict validation or not.