I guess they are going for a safe default... the idea is people who don't carefully read the docs or carefully monitor the provenance of their dynamically gener

I guess they are going for a safe default... the idea is people who don't carefully read the docs or carefully monitor the provenance of their dynamically generated HTML will probably reach for "setHTML()". Meanwhile, there's "setHTMLUnsafe()" and, of course, good old .innerHTML.