There's nothing unsafe about HTML as a language. You'll never get an XSS issue from pure HTML. All of those "bugs" and "security vulnerabilities" come from mis-configured frameworks not properly sanitizing external data, or from (mostly PHP) ad-hoc code written by people unaware of the issue. But even then, any mainstream templating language escapes by default.
It was never so. This attitude in fact is the cause of many bugs and security vulnerabilities, most popularly XSS. There's a reason infrastructure was built around these technologies, one of which is that they are not really safe.