There's nothing unsafe about HTML as a language. You'll never get an XSS issue from pure HTML. All of those "bugs" and "security vulnerabilities" come from mis-configured frameworks not properly sanitizing external data, or from (mostly PHP) ad-hoc code written by people unaware of the issue. But even then, any mainstream templating language escapes by default.