Assuming your entrypoints are typed, TypeScript makes it much harder to accidentally mishandle data of the wrong type and frameworks make it much harder to inadvertently change state at a distance in a way that was unintended. These are the two most common ways that undesired behaviors are introduced to JavaScript UIs.

Is your solution something like “always remember to sanitize user-generated content”?

It’s definitely not a solved problem. Most developers absolutely would not escape their outputs if left to their own devices