Data isn't user-supplied data, so just don't put Javascript code there yourself and you'll be fine.
The second example from the documentation [1] disagrees. It displays HTTP header values, which are user supplied, without properly encoding them.
Also, it's not just about JavaScript. If values aren't properly encoded as HTML, the app is just plain broken when it tries to display text that contains certain character sequences. For example, the app is not capable of displaying the data value "To create a heading in HTML, use <h1>My heading</h1>".
The values need to be separated from the format string and passed through an encoding function such as html.escape [2].
Sure, you're right about that and I agree with the specifics, but your message doesn't feel relevant to the OP or the discussion.
Is it a reasonable expectation that every dev and blog posts must rehash all of OWASP and audit their experimental frameworks (now several years in the making) before publishing?
While JavaScript's template literals [1] would allow this kind of API to work (because the prefix of the template string can be a function that escapes the parameters), Python's f-strings doesn't have equivalent functionality. The tuple returned from the render function should probably include an additional item containing the parameters for the format string (which shouldn't be an f-string).
See also [2].
[1] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
[2] https://en.wikipedia.org/wiki/Uncontrolled_format_string