I think it works for `&` not because innerHTML escapes it when you get, but because it transforms it when you set at first, because `&` alone is invalid. I believe it doesn't work for any other characters if you don't set with `textContent`.

Final thought: do we really want to remove the tags if they're here ? Merely escaping could be enough. I can't think of any use case that would prefer removing the tags over escaping them.

So... my final opinion here would be to `return Utils.escapeHTML(data, true);` (if it's not an "ignored" property) and that's all.